DEV Community: Alex Kane

n8n for HRTech & Workforce Management SaaS: 5 Automations for FLSA Overtime, ACA Reporting, I-9 Compliance, and OSHA 300 Log Sync

Alex Kane — Sat, 30 May 2026 05:51:57 +0000

If you're building HR technology — workforce management SaaS, payroll platforms, benefits administration software, time-tracking systems, or employee self-service portals — your platform sits at the intersection of some of the most heavily regulated data in enterprise software.

FLSA overtime thresholds. ACA employer mandate reporting. I-9 employment eligibility. OSHA 300 injury logs. Every one of these has a federal clock, a penalty schedule, and an audit trail requirement. When your cloud iPaaS is in the data path, it shares responsibility for that clock.

Self-hosted n8n is different. Your workflow logic runs inside your HR platform's infrastructure. Employee PII, I-9 records, and benefits data never flow through third-party servers. The workflow JSON is a git-versioned artifact you can produce for DOL audits, IRS inquiries, or EEOC investigations.

Here are 5 production-ready n8n automations for HRTech SaaS vendors.

1. FLSA Overtime Alert & Manager Notification Workflow

Who it's for: Time-tracking SaaS, workforce scheduling platforms, payroll software

The problem: FLSA §207 requires 1.5x pay for non-exempt employees working over 40 hours/week. The penalty is back wages + equal amount in liquidated damages + attorney fees. Most violations happen because managers don't know until payroll closes — 5–7 days after the overtime already occurred.

The workflow:

Trigger: Cron (daily 18:00 local) or webhook from time-tracking system
Nodes: HTTP Request (pull weekly hours per employee) → Code (flag anyone ≥38h by Wednesday, ≥40h any day) → IF (overtime threshold crossed) → Slack DM to manager + Gmail to HR → Sheets (log overtime_alert with timestamp) → Wait until payroll close → HTTP Request (verify correction)

Import-ready JSON:

{
  "name": "FLSA Overtime Alert",
  "nodes": [
    {
      "type": "n8n-nodes-base.scheduleTrigger",
      "name": "Daily Check",
      "parameters": { "rule": { "interval": [{ "field": "hours", "hoursInterval": 24 }] } }
    },
    {
      "type": "n8n-nodes-base.httpRequest",
      "name": "Get Weekly Hours",
      "parameters": { "url": "={{ $env.HRIS_API_URL }}/hours/weekly", "method": "GET", "authentication": "genericCredentialType" }
    },
    {
      "type": "n8n-nodes-base.code",
      "name": "Flag Overtime Risk",
      "parameters": {
        "jsCode": "const employees = $json.employees || [];\nreturn employees.filter(e => e.hours_this_week >= 38).map(e => ({\n  json: { ...e, risk_level: e.hours_this_week >= 40 ? 'OVERTIME' : 'APPROACHING', checked_at: new Date().toISOString() }\n}));"
      }
    },
    {
      "type": "n8n-nodes-base.slack",
      "name": "Alert Manager",
      "parameters": { "channel": "={{ $json.manager_slack_id }}", "text": "⚠️ FLSA Alert: {{ $json.name }} has {{ $json.hours_this_week }}h this week. Status: {{ $json.risk_level }}" }
    }
  ]
}

2. ACA Employer Mandate — 1094-C/1095-C Data Aggregation Pipeline

Who it's for: Benefits administration SaaS, HRIS platforms, payroll software

The problem: ACA §4980H requires Applicable Large Employers (50+ FTEs) to offer minimum essential coverage or pay the employer shared responsibility payment. The IRS penalty is $2,970/employee/year (2024) for failure to offer coverage. The 1094-C/1095-C filing deadline is February 28 (paper) or March 31 (electronic).

The pain: ACA reporting requires combining data from payroll (hours), benefits (enrollment), and HR (headcount) — three systems that rarely sync automatically.

The workflow:

Trigger: Cron (monthly, 1st of month) + manual trigger for year-end
Nodes: HTTP Request (payroll hours) → HTTP Request (benefits enrollment) → HTTP Request (HR headcount) → Code (calculate FTE count, identify full-time threshold crossings, flag coverage gaps) → Google Sheets (1095-C data staging table) → Gmail (monthly summary to benefits admin)

Import-ready JSON:

{
  "name": "ACA Monthly Data Aggregation",
  "nodes": [
    {
      "type": "n8n-nodes-base.scheduleTrigger",
      "name": "Monthly Trigger",
      "parameters": { "rule": { "interval": [{ "field": "months", "monthsInterval": 1 }] } }
    },
    {
      "type": "n8n-nodes-base.code",
      "name": "Calculate FTE Count",
      "parameters": {
        "jsCode": "const employees = $json.employees;\nconst fullTime = employees.filter(e => e.monthly_hours >= 130);\nconst partTime = employees.filter(e => e.monthly_hours < 130 && e.monthly_hours > 0);\nconst pteFTE = partTime.reduce((s, e) => s + e.monthly_hours, 0) / 120;\nreturn [{ json: { full_time_count: fullTime.length, fte_equivalent: Math.round(fullTime.length + pteFTE), is_ale: (fullTime.length + pteFTE) >= 50, month: new Date().toISOString().slice(0,7) } }];"
      }
    }
  ]
}

3. I-9 Employment Eligibility Expiration Monitor

Who it's for: HRIS platforms, onboarding software, compliance management tools

The problem: 8 U.S.C. §1324a requires I-9 re-verification for employees with temporary work authorization before their employment authorization expires. ICE Form I-9 audits carry civil penalties of $272–$2,701 per violation for paperwork errors and $698–$5,579 per unauthorized worker. Most HR teams lose track of expiring documents in spreadsheets.

The workflow:

Trigger: Cron (daily 07:00)
Nodes: HTTP Request (pull employees with expiring I-9 documents) → Code (bucket by days-to-expiry: 90d warning, 30d urgent, 7d critical, expired) → Switch (route by severity) → Gmail to HR specialist + manager (with re-verification checklist) → Sheets (log alert sent) → IF (expired AND no re-verification) → Slack escalation to legal/CHRO

Import-ready JSON:

{
  "name": "I-9 Expiration Monitor",
  "nodes": [
    {
      "type": "n8n-nodes-base.scheduleTrigger",
      "name": "Daily Monitor",
      "parameters": { "rule": { "interval": [{ "field": "hours", "hoursInterval": 24 }] } }
    },
    {
      "type": "n8n-nodes-base.code",
      "name": "Bucket by Urgency",
      "parameters": {
        "jsCode": "const today = new Date();\nreturn $json.employees\n  .filter(e => e.work_auth_expiry)\n  .map(e => {\n    const expiry = new Date(e.work_auth_expiry);\n    const days = Math.floor((expiry - today) / 86400000);\n    const severity = days < 0 ? 'EXPIRED' : days <= 7 ? 'CRITICAL' : days <= 30 ? 'URGENT' : days <= 90 ? 'WARNING' : 'OK';\n    return { json: { ...e, days_until_expiry: days, severity, checked_at: today.toISOString() } };\n  })\n  .filter(e => e.json.severity !== 'OK');"
      }
    }
  ]
}

4. OSHA 300 Injury Log Sync & 300A Annual Summary Auto-Draft

Who it's for: EHS (environment/health/safety) SaaS, workplace safety platforms, HR compliance tools

The problem: OSHA 29 CFR §1904 requires employers with 10+ employees to maintain an OSHA 300 log of work-related injuries and illnesses. The OSHA 300A annual summary must be posted February 1–April 30 each year. Electronic submission (ITA portal) is required for establishments with 100+ employees in high-hazard industries.

The workflow:

Trigger: Webhook (incident.reported event from safety platform) + Cron (February 1 for annual summary)
Nodes: Webhook (new incident) → Code (classify by OSHA recordability criteria: days away, restricted duty, medical treatment, loss of consciousness, diagnosis of significant injury) → HTTP Request (post to OSHA 300 log database) → Gmail (supervisor notification + 24h follow-up reminder) → [Annual branch] Code (aggregate YTD, calculate incidence rates) → Google Docs (generate 300A draft) → Gmail (to EHS manager for review)

Import-ready JSON:

{
  "name": "OSHA 300 Incident Logger",
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "Incident Reported",
      "parameters": { "path": "incident-reported", "responseMode": "onReceived" }
    },
    {
      "type": "n8n-nodes-base.code",
      "name": "OSHA Recordability Check",
      "parameters": {
        "jsCode": "const i = $json.body;\nconst recordable = i.days_away_from_work > 0 || i.restricted_duty_days > 0 || i.medical_treatment_beyond_first_aid || i.loss_of_consciousness || i.significant_diagnosis;\nreturn [{ json: { ...i, osha_recordable: recordable, case_type: i.days_away_from_work > 0 ? 'DAYS_AWAY' : i.restricted_duty_days > 0 ? 'JOB_TRANSFER' : 'OTHER_RECORDABLE', logged_at: new Date().toISOString() } }];"
      }
    }
  ]
}

5. New Hire Onboarding Compliance Checklist Orchestrator

Who it's for: HRIS onboarding software, HR service delivery platforms, employee experience tools

The problem: A compliant new hire onboarding involves I-9 (3 business days), W-4, state tax forms, benefits enrollment window (typically 30 days), direct deposit setup, mandatory training acknowledgments, and background check completion — each with its own deadline and legal consequence for missing it.

The workflow:

Trigger: Webhook (employee.hired event) or HRIS integration trigger
Nodes: Set (compute all deadline timestamps from hire date) → Code (generate checklist with deadlines) → Gmail Day 0 (welcome + I-9 instruction — "complete within 3 business days") → Wait 2d → IF (I-9 complete?) → Gmail reminder OR escalate to HR → Wait until Day 30 → IF (benefits enrolled?) → Gmail final warning OR log as declined → Sheets (track completion status for each item) → Code (generate compliance summary at Day 45)

Import-ready JSON:

{
  "name": "New Hire Compliance Orchestrator",
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "Employee Hired",
      "parameters": { "path": "employee-hired", "responseMode": "onReceived" }
    },
    {
      "type": "n8n-nodes-base.code",
      "name": "Compute Compliance Deadlines",
      "parameters": {
        "jsCode": "const hire = new Date($json.body.hire_date);\nconst addDays = (d, n) => { const r = new Date(d); r.setDate(r.getDate() + n); return r.toISOString(); };\nreturn [{ json: { ...$json.body,\n  i9_deadline: addDays(hire, 3),\n  benefits_deadline: addDays(hire, 30),\n  w4_deadline: addDays(hire, 7),\n  training_deadline: addDays(hire, 14),\n  compliance_review_date: addDays(hire, 45)\n} }];"
      }
    },
    {
      "type": "n8n-nodes-base.gmail",
      "name": "Day 0 Welcome",
      "parameters": {
        "toEmail": "={{ $json.work_email }}",
        "subject": "Welcome to {{ $json.company_name }} — Your First-Week Checklist",
        "message": "Hi {{ $json.first_name }},\n\nWelcome! To stay compliant, please complete:\n• I-9 Employment Eligibility: within 3 business days (by {{ $json.i9_deadline.slice(0,10) }})\n• W-4 Federal Tax: within 7 days\n• Benefits enrollment: within 30 days (by {{ $json.benefits_deadline.slice(0,10) }})\n\nYour HR team is here to help. Reply to this email with any questions."
      }
    }
  ]
}

Why Self-Hosted n8n for HRTech Compliance Workflows

Employee PII never leaves your infrastructure. Social Security numbers, I-9 documents, medical information, and salary data stay in your network. No third-party iPaaS server touches them.
Audit trail is a git-versioned JSON file. When the DOL audits your overtime practices or ICE requests I-9 records, you produce the workflow JSON as part of your compliance documentation — timestamped, version-controlled, reproducible.
The compliance clock is deterministic. n8n's built-in Wait node and Schedule Trigger fire on exact timestamps. You can prove to an EEOC investigator that the 3-business-day I-9 reminder fired on schedule.
FlowKit ships these as ready-to-import workflow templates. Drop the JSON into your n8n instance, connect your HRIS API credentials, and the workflow is live in minutes — not weeks of custom development.

Free workflow templates for HRTech compliance automation: FlowKit on Gumroad

These workflows are starting-point templates, not legal advice. Verify compliance requirements with qualified employment law counsel before production deployment.

n8n for HealthTech/RPM SaaS Vendors: 5 Automations for HIPAA BAA, ONC TEFCA Information Blocking, FDA SaMD, and FTC Health Breach Notification

Alex Kane — Fri, 29 May 2026 00:34:14 +0000

If your HealthTech SaaS platform processes patient data through a cloud automation vendor, that vendor's execution log recorded the exact timestamp when protected health information first passed through their infrastructure. Under HIPAA 45 CFR §164.408(b), the 60-day HHS breach notification clock starts at discovery — and discovery is defined as when any employee or system first detected the unauthorized access or acquisition of PHI.

That timestamp is in your vendor's log, not yours.

This architectural fact drives four distinct compliance obligations across HIPAA, ONC TEFCA, FDA SaMD, and FTC Health Breach Notification — all of which start clocks at the earliest point of system interaction, not at human review.

The Five Compliance Clocks

1. HIPAA Breach Notification — 60 Days from Discovery

Under 45 CFR §164.408(b), covered entities must notify HHS and affected individuals within 60 days of discovery of a breach. The HIPAA definition of discovery is the date a covered entity or its business associate first knows or, by exercising reasonable diligence, would have known of the breach.

Key architectural consequence: every cloud automation vendor that processes PHI on your behalf is a Business Associate under 45 CFR §164.504(e). If Zapier, Make, or any cloud iPaaS platform executes a workflow containing PHI fields, that vendor must have a signed BAA. If that vendor's infrastructure is breached, the discovery timestamp in their platform's logs is HIPAA evidence — and the 60-day clock starts from that date, not from when your team learns about it.

A second consequence: cloud iPaaS execution logs that contain PHI field values constitute unauthorized disclosure to the vendor. This is one of the most common sources of HIPAA violations in automation-heavy HealthTech platforms — a workflow logs the patient name, DOB, or diagnosis in a debug field, and that data sits in a cloud vendor's log infrastructure outside your HIPAA security boundary.

2. ONC Information Blocking — $1M/Violation

The 21st Century Cures Act §4004 and ONC implementing regulations at 45 CFR §171.103 define "information blocking" as any practice by a health IT developer, health information network, or health information exchange that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.

The OIG can impose civil monetary penalties of up to $1 million per violation on health IT developers. There are eight regulatory exceptions (preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, licensing) — but each exception has specific conditions that must be affirmatively documented.

The clock consequence: when a patient or their authorized representative submits a request for their EHI through your platform, the information blocking obligation is immediate at receipt. Batch processing queues that delay EHI access create a window where the platform may be engaging in information blocking without a valid documented exception.

3. FDA Software as a Medical Device — Before Distribution

The FDA's IMDRF N23 SaMD framework (adopted by FDA in its 2019 Software Policy) defines Software as a Medical Device as software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.

For HealthTech SaaS vendors, the critical question is whether your platform's algorithms generate clinical recommendations that inform treatment, diagnosis, or monitoring decisions. Common examples that have drawn FDA attention: triage scoring algorithms, RPM threshold alert systems that recommend clinical intervention, diagnostic support tools, and chronic disease management recommendations.

Distribution of SaMD without FDA clearance (510(k)) or approval (PMA) is a prohibited act under 21 USC §331. The FDA has issued warning letters and consent decrees to SaaS vendors. The SaMD classification is based on function and intended use, not technical architecture.

4. FTC Health Breach Notification Rule — 60 Days from Discovery

The FTC Health Breach Notification Rule (16 CFR Part 318) applies to vendors of personal health records and related entities that are not HIPAA covered entities or business associates. This includes consumer health apps, wearable device platforms, wellness apps, and other digital health tools that collect health data directly from consumers.

The FTC rule requires notification within 60 days of discovery of a breach. The FTC's definition of "breach" includes unauthorized acquisition of unsecured PHR identifiable health information — and the FTC has made clear that discovery means the point at which the vendor's system first detected unauthorized access, not when the leadership team reviewed the incident report.

The FTC has taken enforcement action under this rule: in 2023 the FTC settled with several health app operators for data sharing practices that triggered breach notification obligations.

5. CMS Interoperability and Prior Authorization API — January 2027

The CMS Interoperability and Prior Authorization Final Rule (2024) requires payers regulated under CMS (MA plans, Medicaid, CHIP, QHP issuers) to implement FHIR R4 Prior Authorization APIs by January 1, 2027. HealthTech SaaS vendors that serve these payers or build prior authorization workflows must have FHIR-compliant API infrastructure in place by that date.

Additionally, 45 CFR §170.315(g)(10) requires certified EHR technology to support a FHIR R4 patient-facing API — HealthTech vendors whose products require EHR integration must be compatible with this API.

The 7 HealthTech SaaS Vendor Tiers

These automations are built for the engineering and compliance teams at HealthTech software companies — not the clinical staff using the platforms.

Tier	Profile	Key Flags
RPM_PLATFORM_SAAS	Remote patient monitoring platforms, >100K patient accounts	HIPAA BAA + ONC TEFCA + SaMD
TELEHEALTH_SAAS	Telehealth and virtual care platforms	HIPAA BAA + CMS Prior Auth API
DIGITAL_THERAPEUTICS	DTx platforms (FDA cleared or pursuing clearance)	FDA SaMD + FTC HBN Rule
CHRONIC_CARE_MANAGEMENT	Chronic disease management platforms	HIPAA + CMS Prior Auth + TEFCA
CLINICAL_DECISION_SUPPORT	CDS tools, diagnostic support, triage algorithms	FDA SaMD (highest risk)
POPULATION_HEALTH_SAAS	Population health management, ACO platforms	ONC TEFCA + HIPAA + GDPR Art.9
HEALTHTECH_STARTUP	Pre-revenue or early-stage health tech	HIPAA basics + FTC HBN if non-CE

The 5 Automations

Workflow 1: Tier-Segmented HealthTech Customer Onboarding Drip

A webhook-triggered onboarding sequence that classifies new accounts into the 7-tier structure, assigns compliance flags (HIPAA BAA, ONC TEFCA, FDA SaMD, CMS Prior Auth, FTC HBN Rule, GDPR Art.9, CCPA sensitive PI), and triggers a 3-part email drip covering HIPAA BAA risk, ONC information blocking architecture, and FDA SaMD classification.

{
  "name": "HealthTech Tier-Segmented Onboarding Drip",
  "nodes": [
    {
      "id": "1",
      "name": "New HealthTech Account Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "healthtech-onboarding",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Classify Tier & Flags",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst arr = parseFloat(d.arr_usd || 0);\nconst accounts = parseInt(d.patient_accounts || 0);\nlet tier = 'HEALTHTECH_STARTUP';\nif (arr >= 5e6 || accounts >= 100000) tier = 'RPM_PLATFORM_SAAS';\nelse if (d.account_type === 'telehealth') tier = 'TELEHEALTH_SAAS';\nelse if (d.account_type === 'digital_therapeutics') tier = 'DIGITAL_THERAPEUTICS';\nelse if (d.account_type === 'chronic_care') tier = 'CHRONIC_CARE_MANAGEMENT';\nelse if (d.account_type === 'clinical_decision') tier = 'CLINICAL_DECISION_SUPPORT';\nelse if (d.account_type === 'population_health') tier = 'POPULATION_HEALTH_SAAS';\nconst flags = {\n  hipaa_covered_entity_or_ba: true,\n  onc_tefca_qhin_participant: ['RPM_PLATFORM_SAAS','POPULATION_HEALTH_SAAS','CHRONIC_CARE_MANAGEMENT'].includes(tier),\n  fda_samd_cleared_or_pending: ['CLINICAL_DECISION_SUPPORT','DIGITAL_THERAPEUTICS','RPM_PLATFORM_SAAS'].includes(tier),\n  cms_prior_auth_api_subject: ['TELEHEALTH_SAAS','CHRONIC_CARE_MANAGEMENT','POPULATION_HEALTH_SAAS'].includes(tier),\n  ftc_hbn_rule_subject: !d.is_covered_entity && ['DIGITAL_THERAPEUTICS','HEALTHTECH_STARTUP'].includes(tier),\n  gdpr_art9_health_data: d.eu_customers === 'true',\n  ccpa_sensitive_pi_health: d.ca_customers === 'true'\n};\nreturn [{json: {...d, tier, flags, onboarding_ts: new Date().toISOString()}}];"
      }
    },
    {
      "id": "3",
      "name": "Day 0 Welcome Email",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.contact_email }}",
        "subject": "=Welcome to FlowKit \u2014 your {{ $json.tier }} HIPAA compliance automation kit",
        "message": "=Welcome to FlowKit.\n\nYour HealthTech compliance stack is ready. Based on your profile ({{ $json.tier }}):\n\n{{ $json.flags.hipaa_covered_entity_or_ba ? '\u2713 HIPAA BAA workflow audit enabled (cloud iPaaS vendor = business associate)\\n' : '' }}{{ $json.flags.onc_tefca_qhin_participant ? '\u2713 ONC TEFCA information blocking monitor active (\u00a7171.103 complaint pipeline)\\n' : '' }}{{ $json.flags.fda_samd_cleared_or_pending ? '\u2713 FDA SaMD IMDRF N23 classification tracker configured (510(k) deadline monitor)\\n' : '' }}{{ $json.flags.cms_prior_auth_api_subject ? '\u2713 CMS Prior Authorization API deadline tracker active (Jan 2027 FHIR R4 mandate)\\n' : '' }}{{ $json.flags.ftc_hbn_rule_subject ? '\u2713 FTC Health Breach Notification Rule 60-day clock configured (16 CFR Part 318)\\n' : '' }}\u2713 HIPAA breach incident pipeline ready (60-day HHS/patient notification tracker)\n\nOnboarding call: {{ $json.csm_calendly_link }}\n\n\u2014 FlowKit Team"
      }
    },
    {
      "id": "4",
      "name": "Slack CSM Alert",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#healthtech-onboarding",
        "text": "=\ud83c\udfe5 New {{ $json.tier }}: {{ $json.company_name }} ({{ $json.patient_accounts }} patient accounts)\nFlags: HIPAA={{ $json.flags.hipaa_covered_entity_or_ba }} | TEFCA={{ $json.flags.onc_tefca_qhin_participant }} | SaMD={{ $json.flags.fda_samd_cleared_or_pending }} | CMS={{ $json.flags.cms_prior_auth_api_subject }} | FTC={{ $json.flags.ftc_hbn_rule_subject }}\nCSM: {{ $json.csm_name }}"
      }
    },
    {
      "id": "5",
      "name": "Audit Log",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "healthtech_onboarding_audit",
        "columns": "company_name,tier,arr_usd,flags_json,onboarding_ts",
        "values": "={{ $json.company_name }},={{ $json.tier }},={{ $json.arr_usd }},={{ JSON.stringify($json.flags) }},={{ $json.onboarding_ts }}"
      }
    },
    {
      "id": "6",
      "name": "Wait 3 Days",
      "type": "n8n-nodes-base.wait",
      "parameters": {
        "amount": 3,
        "unit": "days"
      }
    },
    {
      "id": "7",
      "name": "Day 3 HIPAA BAA Tips",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.contact_email }}",
        "subject": "=HIPAA BAA and cloud automation \u2014 the business associate problem your Zapier vendor won't mention",
        "message": "=Day 3 check-in.\n\nEvery cloud automation platform that processes PHI on your behalf is a Business Associate under HIPAA 45 CFR \u00a7164.504(e). This means:\n\n\u2022 Zapier, Make, or any cloud iPaaS vendor that touches PHI must have a signed BAA\n\u2022 If that vendor suffers a breach, YOUR 60-day HHS notification clock starts at the date you 'discovered' the breach \u2014 discovery = when any employee OR system first detected unauthorized access\n\u2022 Cloud iPaaS logs are in the vendor's infrastructure \u2014 those logs are HHS discovery evidence\n\nWith self-hosted n8n, there is no third-party business associate to sign a BAA with. The automation runs inside your HIPAA security boundary.\n\nFlowKit's HIPAA breach pipeline (Workflow 4) captures the discovery timestamp the moment a PHI incident hits your webhook endpoint.\n\nQuestions: {{ $json.csm_email }}"
      }
    },
    {
      "id": "8",
      "name": "Wait 4 Days",
      "type": "n8n-nodes-base.wait",
      "parameters": {
        "amount": 4,
        "unit": "days"
      }
    },
    {
      "id": "9",
      "name": "Day 7 ONC TEFCA & FDA SaMD",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.contact_email }}",
        "subject": "=ONC information blocking $1M/violation + FDA SaMD \u2014 what your HealthTech platform must know",
        "message": "=Day 7 update.\n\nTwo compliance areas with high penalty density for HealthTech SaaS vendors:\n\n1. ONC Information Blocking (45 CFR \u00a7171): If your platform interferes with patient access to their electronic health information without a valid exception, that is 'information blocking' \u2014 $1M/violation civil penalty per OIG. The clock starts when the patient request hits your system, not when your operations team reviews the queue.\n\n2. FDA SaMD (IMDRF N23): If your platform's algorithms generate clinical recommendations that inform treatment decisions (dosing alerts, diagnostic suggestions, triage scores), you may be manufacturing a Software as a Medical Device. Distribution without 510(k) clearance is FDA enforcement risk.\n\nFlowKit's FDA SaMD deadline tracker (Workflow 2) monitors your 510(k) submission status and flags approaching deadlines before OIG or FDA acts.\n\nCompliance review: {{ $json.compliance_email }}"
      }
    }
  ],
  "connections": {
    "New HealthTech Account Webhook": {
      "main": [
        [
          {
            "node": "Classify Tier & Flags",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Tier & Flags": {
      "main": [
        [
          {
            "node": "Day 0 Welcome Email",
            "type": "main",
            "index": 0
          },
          {
            "node": "Slack CSM Alert",
            "type": "main",
            "index": 0
          },
          {
            "node": "Audit Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Day 0 Welcome Email": {
      "main": [
        [
          {
            "node": "Wait 3 Days",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 3 Days": {
      "main": [
        [
          {
            "node": "Day 3 HIPAA BAA Tips",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Day 3 HIPAA BAA Tips": {
      "main": [
        [
          {
            "node": "Wait 4 Days",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 4 Days": {
      "main": [
        [
          {
            "node": "Day 7 ONC TEFCA & FDA SaMD",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 2: HIPAA / ONC / FDA SaMD / FTC HBN Compliance Deadline Tracker

A daily 7AM scheduler that reads compliance deadlines from a Google Sheet, classifies each by urgency (OVERDUE / CRITICAL / URGENT / WARNING / NOTICE), and routes alerts to Gmail and Slack. Covers 12 deadline types including HIPAA_BREACH_HHS_60DAY, FTC_HBN_RULE_60DAY, ONC_INFO_BLOCKING_RESPONSE, FDA_SAMD_510K_SUBMISSION, FDA_MDR_30DAY, and CMS_PRIOR_AUTH_API_JAN2027.

{
  "name": "HIPAA / ONC / FDA SaMD / FTC HBN Compliance Deadline Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Daily 7AM UTC",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * *"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "read",
        "sheetId": "YOUR_SHEET_ID",
        "range": "HealthTech_Deadlines!A:J"
      }
    },
    {
      "id": "3",
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const items = $input.all();\nconst now = new Date();\nconst DEADLINE_MAP = {\n  'HIPAA_RISK_ASSESSMENT_ANNUAL': 'HIPAA 45 CFR \u00a7164.308(a)(1) \u2014 annual security risk assessment required',\n  'HIPAA_BAA_REVIEW_ANNUAL': 'HIPAA 45 CFR \u00a7164.504(e) \u2014 annual BAA review for all cloud vendors handling PHI',\n  'HIPAA_BREACH_HHS_60DAY': 'HIPAA 45 CFR \u00a7164.408(b) \u2014 HHS breach notification within 60 days of discovery',\n  'HIPAA_BREACH_ANNUAL_REPORT': 'HIPAA 45 CFR \u00a7164.408(c) \u2014 annual report of small breaches (<500 individuals)',\n  'FTC_HBN_RULE_60DAY': 'FTC 16 CFR Part 318 \u2014 health breach notification within 60 days of discovery (non-HIPAA health apps)',\n  'ONC_INFO_BLOCKING_RESPONSE': 'ONC 45 CFR \u00a7171.103 \u2014 actor must respond to information blocking complaint (IMMEDIATE + documentation)',\n  'FDA_SAMD_510K_SUBMISSION': 'FDA SaMD IMDRF N23 \u2014 510(k) premarket notification before commercial distribution',\n  'FDA_SAMD_ANNUAL_REPORT': 'FDA 21 CFR \u00a7814.84 \u2014 annual PMA report (if PMA approved)',\n  'FDA_MDR_30DAY': 'FDA 21 CFR \u00a7803.50 \u2014 Medical Device Report within 30 days of becoming aware of adverse event',\n  'CMS_PRIOR_AUTH_API_JAN2027': 'CMS Interoperability Final Rule 2024 \u2014 prior authorization FHIR API compliance deadline January 1, 2027',\n  'GDPR_ART9_DPIA_ANNUAL': 'GDPR Art.35 \u2014 DPIA review for health data processing (annual recommended)',\n  'SOC2_TYPE2_ANNUAL': 'SOC2 Type II annual audit \u2014 required for enterprise HealthTech buyers'\n};\nconst alerts = [];\nfor (const item of items) {\n  const d = item.json;\n  if (!d.deadline_date || !d.deadline_type) continue;\n  const deadline = new Date(d.deadline_date);\n  const days = Math.ceil((deadline - now) / 86400000);\n  let urgency = null;\n  if (days < 0) urgency = 'OVERDUE';\n  else if (days <= 3) urgency = 'CRITICAL';\n  else if (days <= 7) urgency = 'URGENT';\n  else if (days <= 14) urgency = 'WARNING';\n  else if (days <= 30) urgency = 'NOTICE';\n  if (urgency) {\n    alerts.push({json: {\n      ...d, urgency, days_remaining: days,\n      regulation_citation: DEADLINE_MAP[d.deadline_type] || d.deadline_type,\n      subject: urgency + ': ' + d.deadline_type + ' \u2014 ' + days + 'd remaining'\n    }});\n  }\n}\nreturn alerts.length ? alerts : [{json: {skip: true, message: 'No deadlines requiring alert today'}}];"
      }
    },
    {
      "id": "4",
      "name": "Skip if No Alerts",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.skip }}",
              "value2": true
            }
          ]
        }
      }
    },
    {
      "id": "5",
      "name": "Gmail Compliance Alert",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.compliance_email }}",
        "subject": "={{ $json.subject }}",
        "message": "=HealthTech Compliance Alert: {{ $json.urgency }}\n\nDeadline: {{ $json.deadline_type }}\nDue: {{ $json.deadline_date }} ({{ $json.days_remaining }} days)\nRegulation: {{ $json.regulation_citation }}\n\nAccount: {{ $json.company_name }} ({{ $json.tier }})\nOwner: {{ $json.owner_name }}\n\nAction required: {{ $json.action_required }}\n\n\u2014 FlowKit HealthTech Compliance Tracker"
      }
    },
    {
      "id": "6",
      "name": "Slack Compliance Channel",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#healthtech-compliance-alerts",
        "text": "={{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.company_name }} \u2014 {{ $json.days_remaining }}d remaining\n{{ $json.regulation_citation }}"
      }
    }
  ],
  "connections": {
    "Daily 7AM UTC": {
      "main": [
        [
          {
            "node": "Fetch Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Deadlines": {
      "main": [
        [
          {
            "node": "Classify Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Urgency": {
      "main": [
        [
          {
            "node": "Skip if No Alerts",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Skip if No Alerts": {
      "main": [
        [],
        [
          {
            "node": "Gmail Compliance Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail Compliance Alert": {
      "main": [
        [
          {
            "node": "Slack Compliance Channel",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 3: HealthTech API Health Monitor (FHIR / PHI Pipeline / TEFCA / SaMD)

A 5-minute polling monitor across 5 endpoints — EHR FHIR API, RPM device ingestion, ONC TEFCA QHIN API, FDA SaMD validation engine, and HIPAA audit log API — using $getWorkflowStaticData for state change deduplication. Each endpoint carries a compliance annotation: for example, a TEFCA QHIN outage is flagged as a potential ONC information blocking event ($1M/violation).

{
  "name": "HealthTech API Health Monitor (FHIR / PHI / TEFCA / FTC / SaMD)",
  "nodes": [
    {
      "id": "1",
      "name": "Every 5 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 5
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Check All Endpoints",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const state = $getWorkflowStaticData('global');\nstate.prev = state.prev || {};\nconst endpoints = [\n  { key: 'ehr_fhir_api', url: process.env.EHR_FHIR_API_URL || 'https://fhir.your-ehr.com/health', annotation: 'HIPAA PHI transmission \u2014 down means FHIR R4 data exchange interrupted (CMS \u00a7170.315(g)(10) obligation)' },\n  { key: 'rpm_device_ingestion', url: process.env.RPM_DEVICE_URL || 'https://rpm.yourplatform.com/ingest/health', annotation: 'RPM vital sign stream \u2014 down means patient alert pipeline broken (potential patient safety event)' },\n  { key: 'tefca_qhin_api', url: process.env.TEFCA_QHIN_URL || 'https://qhin.yourplatform.com/health', annotation: 'ONC TEFCA QHIN \u2014 down means information blocking risk (45 CFR \u00a7171.103 \u2014 $1M/violation)' },\n  { key: 'fda_samd_validation', url: process.env.FDA_SAMD_URL || 'https://samd.yourplatform.com/validation/health', annotation: 'FDA SaMD clinical decision engine \u2014 down means clinical recommendations unavailable (SaMD malfunction event)' },\n  { key: 'hipaa_audit_log', url: process.env.HIPAA_AUDIT_URL || 'https://audit.yourplatform.com/health', annotation: 'HIPAA \u00a7164.312(b) audit log \u2014 down means PHI access events not being recorded (audit trail gap)' }\n];\nconst results = [];\nfor (const ep of endpoints) {\n  try {\n    const r = await $helpers.httpRequest({ method: 'GET', url: ep.url, timeout: 10000 });\n    const status = (r.status === 'ok' || r.healthy === true) ? 'UP' : 'DEGRADED';\n    const prev = state.prev[ep.key] || 'UP';\n    const changed = status !== prev;\n    state.prev[ep.key] = status;\n    results.push({ json: { ...ep, status, prev_status: prev, changed, ts: new Date().toISOString() } });\n  } catch (e) {\n    const prev = state.prev[ep.key] || 'UP';\n    state.prev[ep.key] = 'DOWN';\n    results.push({ json: { ...ep, status: 'DOWN', prev_status: prev, changed: prev !== 'DOWN', error: e.message, ts: new Date().toISOString() } });\n  }\n}\nreturn results;"
      }
    },
    {
      "id": "3",
      "name": "State Changed?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.changed }}",
              "value2": true
            }
          ]
        }
      }
    },
    {
      "id": "4",
      "name": "Slack Health Alert",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#healthtech-ops-alerts",
        "text": "={{ $json.status === 'DOWN' ? '\ud83d\udd34' : $json.status === 'DEGRADED' ? '\ud83d\udfe1' : '\ud83d\udfe2' }} {{ $json.key }} \u2192 {{ $json.status }} (was {{ $json.prev_status }})\n{{ $json.annotation }}\nError: {{ $json.error || 'none' }}"
      }
    }
  ],
  "connections": {
    "Every 5 Minutes": {
      "main": [
        [
          {
            "node": "Check All Endpoints",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check All Endpoints": {
      "main": [
        [
          {
            "node": "State Changed?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "State Changed?": {
      "main": [
        [
          {
            "node": "Slack Health Alert",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}

Workflow 4: HIPAA Breach / FTC HBN / ONC Information Blocking Incident Pipeline

A webhook-triggered incident pipeline handling 8 incident types with pre-computed compliance deadlines, required action lists, and regulatory citations. Key incident types:

HIPAA_PHI_UNAUTHORIZED_ACCESS → 60-day HHS + patient notification clock from discovery timestamp
FTC_HBN_HEALTH_DATA_BREACH → 60-day FTC notification from discovery (applies to non-HIPAA health apps)
ONC_INFO_BLOCKING_COMPLAINT → IMMEDIATE acknowledgment required ($1M/violation)
FDA_SAMD_ADVERSE_EVENT → 30-day MDR (21 CFR §803.50) from awareness of malfunction
PHI_IN_CLOUD_AUTOMATION_LOG → 4-hour IMMEDIATE — PHI in cloud iPaaS log = unauthorized disclosure
GDPR_ART9_HEALTH_DATA_BREACH → 72-hour supervisory authority notification (Art.33)

The pipeline writes the discovery_ts to Postgres at the moment of webhook receipt — before any human reviews the incident.

{
  "name": "HIPAA Breach / FTC HBN / ONC Information Blocking Incident Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "Incident Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "healthtech-incident",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Classify Incident",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst now = new Date();\nconst INCIDENT_MAP = {\n  'HIPAA_PHI_UNAUTHORIZED_ACCESS': {\n    sla_hours: null, sla_days: 60, clock: '60-day HHS + patient notification from discovery (45 CFR \u00a7164.408(b))',\n    actions: ['quarantine_phi_record', 'notify_privacy_officer', 'begin_breach_risk_assessment', 'log_discovery_timestamp'],\n    note: 'Discovery = when any employee OR system first detected unauthorized access. Platform webhook receipt timestamp IS the discovery evidence.'\n  },\n  'FTC_HBN_HEALTH_DATA_BREACH': {\n    sla_hours: null, sla_days: 60, clock: '60-day FTC notification from discovery (16 CFR Part 318) \u2014 applies to non-HIPAA health apps and wearables',\n    actions: ['notify_ftc_web_form', 'notify_affected_individuals', 'log_discovery_timestamp'],\n    note: 'FTC Health Breach Notification Rule applies to PHR vendors and health app developers NOT covered by HIPAA. Clock starts at discovery.'\n  },\n  'ONC_INFO_BLOCKING_COMPLAINT': {\n    sla_hours: 72, sla_days: null, clock: 'IMMEDIATE acknowledgment required \u2014 $1M/violation civil penalty per OIG (21st Century Cures Act \u00a74004)',\n    actions: ['acknowledge_request', 'document_exception_applicability', 'begin_response_workflow'],\n    note: 'Information blocking = any practice that interferes with access/exchange/use of EI without valid exception. 8 regulatory exceptions exist.'\n  },\n  'FDA_SAMD_ADVERSE_EVENT': {\n    sla_hours: null, sla_days: 30, clock: '30-day MDR submission (FDA 21 CFR \u00a7803.50) \u2014 from date of awareness of device malfunction',\n    actions: ['quarantine_affected_algorithm_version', 'notify_fda_medwatch', 'begin_capa'],\n    note: 'If SaMD clinical recommendation contributed to patient harm or malfunction, MDR required within 30 days.'\n  },\n  'HIPAA_BAA_VENDOR_BREACH': {\n    sla_hours: null, sla_days: 60, clock: '60-day notification to covered entity from BA discovery (45 CFR \u00a7164.410)',\n    actions: ['notify_covered_entity_contacts', 'produce_breach_risk_assessment', 'update_baa_incident_log'],\n    note: 'Business associate must notify covered entity without unreasonable delay and no later than 60 days of discovery.'\n  },\n  'PHI_IN_CLOUD_AUTOMATION_LOG': {\n    sla_hours: 4, sla_days: null, clock: 'IMMEDIATE \u2014 PHI appearing in cloud iPaaS execution log is unauthorized disclosure (45 CFR \u00a7164.502)',\n    actions: ['purge_phi_from_log', 'quarantine_workflow_run', 'notify_privacy_officer', 'assess_breach_risk'],\n    note: 'Cloud iPaaS execution logs that contain PHI field values are unauthorized disclosures to the vendor. This is a common source of HIPAA violations in automation platforms.'\n  },\n  'GDPR_ART9_HEALTH_DATA_BREACH': {\n    sla_hours: 72, sla_days: null, clock: '72-hour supervisory authority notification (GDPR Art.33) \u2014 for EU health data breaches',\n    actions: ['notify_lead_sa', 'assess_risk_to_data_subjects', 'document_breach_register'],\n    note: 'Art.9 health data breaches carry higher risk assessment threshold. 72h clock from awareness, not from discovery of full scope.'\n  },\n  'CMS_PRIOR_AUTH_FHIR_OUTAGE': {\n    sla_hours: 4, sla_days: null, clock: 'IMMEDIATE \u2014 CMS Interoperability Rule \u00a7170.315(g)(10) API downtime must be logged with reason and duration',\n    actions: ['document_outage_start_ts', 'notify_affected_payer_partners', 'escalate_to_oncall'],\n    note: 'CMS requires documentation of API availability. Extended outages affecting prior authorization determinations must be logged for CMS audit.'\n  }\n};\nconst type = d.incident_type || 'UNKNOWN';\nconst config = INCIDENT_MAP[type] || { sla_hours: 24, clock: 'Unknown incident type \u2014 treat as 24h default', actions: ['investigate'], note: '' };\nconst deadline_ts = config.sla_hours\n  ? new Date(now.getTime() + config.sla_hours * 3600000).toISOString()\n  : new Date(now.getTime() + config.sla_days * 86400000).toISOString();\nreturn [{json: {\n  ...d, incident_config: config, type, discovery_ts: now.toISOString(),\n  deadline_ts, deadline_label: config.clock, incident_note: config.note\n}}];"
      }
    },
    {
      "id": "3",
      "name": "Postgres Incident Audit",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "healthtech_incident_log",
        "columns": "incident_type,company_name,discovery_ts,deadline_ts,clock_label,actions_json,raw_payload",
        "values": "={{ $json.type }},={{ $json.company_name }},={{ $json.discovery_ts }},={{ $json.deadline_ts }},={{ $json.deadline_label }},={{ JSON.stringify($json.incident_config.actions) }},={{ JSON.stringify($json) }}"
      }
    },
    {
      "id": "4",
      "name": "Slack Incident Alert",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#healthtech-incidents",
        "text": "=\ud83d\udea8 {{ $json.type }}: {{ $json.company_name }}\nClock: {{ $json.deadline_label }}\nDeadline: {{ $json.deadline_ts }}\nActions: {{ $json.incident_config.actions.join(' \u2192 ') }}\nNote: {{ $json.incident_note }}"
      }
    },
    {
      "id": "5",
      "name": "Privacy Officer Email",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.privacy_officer_email || $json.compliance_email }}",
        "subject": "=INCIDENT: {{ $json.type }} \u2014 {{ $json.company_name }} \u2014 clock: {{ $json.deadline_label }}",
        "message": "=HealthTech Compliance Incident\n\nType: {{ $json.type }}\nCompany: {{ $json.company_name }}\nDiscovery timestamp: {{ $json.discovery_ts }}\nCompliance deadline: {{ $json.deadline_ts }}\nRegulatory clock: {{ $json.deadline_label }}\n\nRequired actions:\n{{ $json.incident_config.actions.map((a, i) => (i+1) + '. ' + a).join('\\n') }}\n\nCompliance note: {{ $json.incident_note }}\n\nThis incident has been logged with discovery_ts = {{ $json.discovery_ts }}. All subsequent regulatory notifications must reference this timestamp as the discovery date.\n\n\u2014 FlowKit HealthTech Incident Pipeline"
      }
    }
  ],
  "connections": {
    "Incident Webhook": {
      "main": [
        [
          {
            "node": "Classify Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Incident": {
      "main": [
        [
          {
            "node": "Postgres Incident Audit",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres Incident Audit": {
      "main": [
        [
          {
            "node": "Slack Incident Alert",
            "type": "main",
            "index": 0
          },
          {
            "node": "Privacy Officer Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 5: Weekly HealthTech Platform KPI Dashboard

A Monday 8AM report covering accounts by tier, total ARR, total patient accounts, RPM/SaMD/TEFCA account counts, and compliance events from the previous 7 days. Sends HTML email to CEO with BCC to CISO and Privacy Officer.

{
  "name": "Weekly HealthTech Platform KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 8AM ET",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 13 * * 1"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Accounts by Tier",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT tier, COUNT(*) as count, SUM(arr_usd) as arr_total, SUM(patient_accounts) as total_patients FROM healthtech_accounts WHERE status='active' GROUP BY tier ORDER BY arr_total DESC"
      }
    },
    {
      "id": "3",
      "name": "Fetch Compliance Events",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT incident_type, COUNT(*) as count FROM healthtech_incident_log WHERE created_at >= NOW() - INTERVAL '7 days' GROUP BY incident_type ORDER BY count DESC"
      }
    },
    {
      "id": "4",
      "name": "Build KPI Report",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const accounts = $('Fetch Accounts by Tier').all().map(i => i.json);\nconst incidents = $('Fetch Compliance Events').all().map(i => i.json);\nconst totalArr = accounts.reduce((s, a) => s + parseFloat(a.arr_total || 0), 0);\nconst totalPatients = accounts.reduce((s, a) => s + parseInt(a.total_patients || 0), 0);\nconst rpmCount = accounts.filter(a => a.tier === 'RPM_PLATFORM_SAAS').length;\nconst samdCount = accounts.filter(a => ['CLINICAL_DECISION_SUPPORT','DIGITAL_THERAPEUTICS'].includes(a.tier)).length;\nconst tefcaCount = accounts.filter(a => a.tier === 'POPULATION_HEALTH_SAAS').length;\nconst totalIncidents = incidents.reduce((s, i) => s + parseInt(i.count || 0), 0);\nconst hipaaBreaches = incidents.filter(i => i.incident_type.includes('HIPAA')).reduce((s, i) => s + parseInt(i.count || 0), 0);\nconst rows = accounts.map(a =>\n  '<tr><td style=\"padding:4px 8px\">' + a.tier + '</td><td style=\"padding:4px 8px;text-align:right\">' + a.count + '</td><td style=\"padding:4px 8px;text-align:right\">$' + (parseInt(a.arr_total || 0)).toLocaleString() + '</td><td style=\"padding:4px 8px;text-align:right\">' + (parseInt(a.total_patients || 0)).toLocaleString() + '</td></tr>'\n).join('');\nconst incidentRows = incidents.map(i =>\n  '<tr><td style=\"padding:4px 8px\">' + i.incident_type + '</td><td style=\"padding:4px 8px;text-align:right\">' + i.count + '</td></tr>'\n).join('');\nconst html = '<h2>HealthTech Weekly KPI</h2>' +\n  '<p>Period: Last 7 days | Generated: ' + new Date().toISOString() + '</p>' +\n  '<table border=\"1\" cellpadding=\"0\" cellspacing=\"0\" style=\"border-collapse:collapse\">' +\n  '<tr style=\"background:#f0f0f0\"><th style=\"padding:4px 8px\">Tier</th><th style=\"padding:4px 8px\">Accounts</th><th style=\"padding:4px 8px\">ARR</th><th style=\"padding:4px 8px\">Patient Accounts</th></tr>' +\n  rows + '</table>' +\n  '<p><strong>Total ARR:</strong> $' + totalArr.toLocaleString() + ' | <strong>Total Patients:</strong> ' + totalPatients.toLocaleString() + ' | <strong>RPM Accounts:</strong> ' + rpmCount + ' | <strong>SaMD Accounts:</strong> ' + samdCount + ' | <strong>TEFCA Participants:</strong> ' + tefcaCount + '</p>' +\n  '<h3>Compliance Events (last 7 days)</h3>' +\n  '<table border=\"1\" cellpadding=\"0\" cellspacing=\"0\" style=\"border-collapse:collapse\">' +\n  '<tr style=\"background:#f0f0f0\"><th style=\"padding:4px 8px\">Incident Type</th><th style=\"padding:4px 8px\">Count</th></tr>' +\n  incidentRows + '</table>' +\n  '<p><strong>Total incidents:</strong> ' + totalIncidents + ' | <strong>HIPAA-related:</strong> ' + hipaaBreaches + '</p>';\nreturn [{json: { html, totalArr, totalPatients, totalIncidents, hipaaBreaches }}];"
      }
    },
    {
      "id": "5",
      "name": "Gmail KPI Report",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "ceo@yourcompany.com",
        "bcc": "ciso@yourcompany.com,privacy@yourcompany.com",
        "subject": "=HealthTech Weekly KPI \u2014 ARR ${{ $json.totalArr.toLocaleString() }} \u2014 {{ $json.totalIncidents }} compliance events",
        "message": "={{ $json.html }}",
        "options": {
          "ccList": "",
          "appendAttribution": false
        }
      }
    }
  ],
  "connections": {
    "Monday 8AM ET": {
      "main": [
        [
          {
            "node": "Fetch Accounts by Tier",
            "type": "main",
            "index": 0
          },
          {
            "node": "Fetch Compliance Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Accounts by Tier": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Compliance Events": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Report": {
      "main": [
        [
          {
            "node": "Gmail KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Why Self-Hosted n8n Closes the HIPAA BAA Problem

1. No cloud business associate to sign a BAA with. With self-hosted n8n running inside your HIPAA security boundary, PHI never leaves your infrastructure for automation purposes. There is no cloud vendor to execute a BAA with — because there is no cloud vendor processing the data.

2. Discovery timestamp is under your control. When a HIPAA breach occurs, the 60-day clock starts at discovery. With self-hosted n8n, the workflow execution logs are in your Postgres database, under your retention policy, without a third-party vendor's log infrastructure becoming HHS evidence.

3. ONC information blocking audit trail stays in your boundary. If OIG investigates an information blocking complaint, the audit trail of when your system received the patient request and when you responded is in your infrastructure — not in a cloud vendor's logs outside your security perimeter.

4. FDA SaMD validation evidence stays with you. For FDA SaMD vendors, the clinical algorithm validation audit trail (21 CFR §820.70) must be under the device manufacturer's control. Cloud iPaaS execution logs that contain SaMD decision data are part of the device master record — and they're on vendor infrastructure.

These workflows are available in the FlowKit n8n Template Store. Import-ready JSON — no vendor lock-in, runs on your own infrastructure.

n8n for WealthTech/RIA SaaS Vendors: 5 Automations for SEC Form ADV, Custody Rule, GIPS 2020, and Marketing Rule Compliance

Alex Kane — Fri, 29 May 2026 00:19:25 +0000

If you build investment management SaaS, you already know the regulation stack is brutal. Form ADV Part 2A annual amendments. SEC Custody Rule surprise examinations. GIPS 2020 composite construction requirements. FINRA TRACE real-time bond reporting. Form PF quarterly filings. CFTC NFA renewals. And the new SEC Marketing Rule governing every performance claim your clients publish.

Every one of these has a hard clock. Miss the Form ADV 90-day window and you're filing a late amendment with an explanation. Miss a FINRA TRACE report (15-minute clock from execution) and you're looking at fines up to $1M per violation. Let a GIPS composite run without net returns and your GIPS verifier flags a material non-compliance.

What makes this worse: running these compliance trackers on Zapier adds Zapier to your own compliance scope. Your Form ADV Part 2A strategy descriptions and client risk profiles flow through Zapier's multi-tenant cloud — that's an undocumented third-party processor under SEC Reg S-P §248.3. Your GIPS composite performance data, with AUM and return attribution, routes through shared task logs visible to every workspace member. Your SEC Marketing Rule review workflows, which handle performance advertising materials, create audit trails that regulators can request during an OCIE examination — and Zapier's 30-day log retention won't survive that request.

Self-hosted n8n closes all of these gaps: client data stays in your infrastructure, workflows are git-versioned (audit-ready), and you control exactly who can see what.

Here are 5 workflows every WealthTech/RIA SaaS platform needs, with full import-ready JSON for each.

Who This Is For

These workflows are for WealthTech and RIA SaaS vendors — companies building the software that investment advisers, wealth managers, and hedge funds run on:

Tier	Profile	Key Regulations
ENTERPRISE_RIA_PLATFORM	$10B+ AUM platform or $2M+ ARR	ADV Part 2A, Custody Rule, GIPS, Marketing Rule
MID_MARKET_WEALTH_MGMT	$1B+ AUM or $500K+ ARR	ADV Part 2A, GIPS, Form PF
ROBO_ADVISOR_SAAS	Automated advisory platform	SEC Reg BI, Marketing Rule, FINRA
HEDGE_FUND_SAAS	Fund admin / analytics for hedge funds	TRACE, Form PF, CFTC NFA, GIPS
FAMILY_OFFICE_SAAS	Single/multi-family office software	ADV Part 2A, Custody Rule, GIPS
CRYPTO_WEALTH_SAAS	Digital asset wealth management	CFTC NFA, FinCEN, state MSB
WEALTHTECH_STARTUP	Early-stage investment platform	Marketing Rule, SOC 2 baseline

Workflow 1: RIA Platform Client Onboarding Drip

Triggered when a new RIA firm account appears in your CRM sheet. Classifies the firm into one of 7 tiers, sets 7 compliance flags (ADV Part 2A required, Custody Rule applicable, GIPS compliant, FINRA TRACE applicable, Form PF required, CFTC NFA member, Marketing Rule applicable), fires a tier-appropriate Day 0 email listing exactly which compliance modules are active, posts to Slack CSM channel, writes a SOC 2 CC7.1 audit log entry, then runs Day 3 (Form ADV Part 2A checklist) and Day 7 (SEC Marketing Rule requirements) follow-ups.

{
  "name": "RIA Platform Client Onboarding Drip",
  "nodes": [
    {
      "id": "1",
      "name": "New RIA Account in Sheets",
      "type": "n8n-nodes-base.googleSheetsTrigger",
      "parameters": {
        "sheetId": "YOUR_SHEET_ID",
        "range": "Accounts!A:M",
        "pollTime": {
          "mode": "everyMinute"
        }
      }
    },
    {
      "id": "2",
      "name": "Classify RIA Tier & Flags",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst aum = parseFloat(d.aum_usd || 0);\nconst arr = parseFloat(d.arr_usd || 0);\nlet tier = 'WEALTHTECH_STARTUP';\nif (aum >= 10e9 || arr >= 2e6) tier = 'ENTERPRISE_RIA_PLATFORM';\nelse if (aum >= 1e9 || arr >= 500000) tier = 'MID_MARKET_WEALTH_MGMT';\nelse if (d.account_type === 'robo_advisor') tier = 'ROBO_ADVISOR_SAAS';\nelse if (d.account_type === 'hedge_fund') tier = 'HEDGE_FUND_SAAS';\nelse if (d.account_type === 'family_office') tier = 'FAMILY_OFFICE_SAAS';\nelse if (d.account_type === 'crypto_wealth') tier = 'CRYPTO_WEALTH_SAAS';\nconst flags = {\n  sec_adv_part2a_required: ['ENTERPRISE_RIA_PLATFORM','MID_MARKET_WEALTH_MGMT','HEDGE_FUND_SAAS','FAMILY_OFFICE_SAAS'].includes(tier),\n  sec_custody_rule_applicable: aum >= 150e6,\n  gips_compliant: ['ENTERPRISE_RIA_PLATFORM','MID_MARKET_WEALTH_MGMT','HEDGE_FUND_SAAS'].includes(tier),\n  finra_trace_applicable: tier === 'HEDGE_FUND_SAAS' || (d.fixed_income_trading === 'true'),\n  form_pf_required: (aum >= 150e6 && aum < 1.5e9) || (d.hedge_fund_strategy && aum >= 150e6),\n  cftc_nfa_member: d.cftc_registered === 'true',\n  sec_marketing_rule_applicable: true\n};\nreturn [{json: {...d, tier, flags, onboarding_ts: new Date().toISOString()}}];"
      }
    },
    {
      "id": "3",
      "name": "Day 0 Welcome + Compliance Kit",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.contact_email }}",
        "subject": "=Welcome to FlowKit \u2014 your {{ $json.tier }} compliance automation kit",
        "message": "=Welcome to FlowKit.\n\nYour RIA compliance automation stack is ready. Based on your profile ({{ $json.tier }}, AUM ${{ $json.aum_usd }}):\n\n{{ $json.flags.sec_adv_part2a_required ? '\u2713 SEC Form ADV Part 2A annual disclosure workflow activated (90-day window tracker)\\n' : '' }}{{ $json.flags.sec_custody_rule_applicable ? '\u2713 SEC Custody Rule \u00a7275.206(4)-2 surprise examination trigger configured\\n' : '' }}{{ $json.flags.gips_compliant ? '\u2713 GIPS 2020 composite construction monitor enabled\\n' : '' }}{{ $json.flags.finra_trace_applicable ? '\u2713 FINRA TRACE ATS real-time reporting pipeline ready\\n' : '' }}{{ $json.flags.form_pf_required ? '\u2713 Form PF quarterly filing automation (\u00a7275.204(b)-1 small adviser)\\n' : '' }}{{ $json.flags.cftc_nfa_member ? '\u2713 CFTC NFA membership renewal tracker active\\n' : '' }}\u2713 SEC Marketing Rule \u00a7275.206(4)-1 performance claim validator active\n\nOnboarding call: {{ $json.csm_calendly_link }}\n\n\u2014 FlowKit Team"
      }
    },
    {
      "id": "4",
      "name": "Slack CSM Channel",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#ria-onboarding",
        "text": "=\ud83c\udfe6 New {{ $json.tier }}: {{ $json.firm_name }} (AUM: ${{ $json.aum_usd }})\nFlags: ADV={{ $json.flags.sec_adv_part2a_required }} | Custody={{ $json.flags.sec_custody_rule_applicable }} | GIPS={{ $json.flags.gips_compliant }} | TRACE={{ $json.flags.finra_trace_applicable }} | FormPF={{ $json.flags.form_pf_required }} | NFA={{ $json.flags.cftc_nfa_member }}\nCSM: {{ $json.csm_name }}"
      }
    },
    {
      "id": "5",
      "name": "Audit Log",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "ria_onboarding_audit",
        "columns": "firm_name,tier,aum_usd,flags_json,onboarding_ts",
        "values": "={{ $json.firm_name }},={{ $json.tier }},={{ $json.aum_usd }},={{ JSON.stringify($json.flags) }},={{ $json.onboarding_ts }}"
      }
    },
    {
      "id": "6",
      "name": "Wait 3 Days",
      "type": "n8n-nodes-base.wait",
      "parameters": {
        "amount": 3,
        "unit": "days"
      }
    },
    {
      "id": "7",
      "name": "Day 3 ADV Checklist",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.contact_email }}",
        "subject": "=Form ADV Part 2A delivery checklist \u2014 90-day window starts your fiscal year end",
        "message": "=Day 3 check-in.\n\nSEC Form ADV Part 2A annual amendment must be filed within 90 days of your fiscal year end (Advisers Act Rule 204-1(a)). Your fiscal year end: {{ $json.fiscal_year_end }}.\n\nChecklist:\n\u25a1 Material changes: update Part 2A within 30 days\n\u25a1 Annual amendment: file within 90 days of FYE\n\u25a1 Custody accounts: identify and mark for surprise exam eligibility\n\u25a1 GIPS composites: verify all accounts assigned to appropriate composite\n\nFlowKit deadline tracker has pre-loaded these deadlines. You can adjust dates at: YOUR_SHEET_URL"
      }
    },
    {
      "id": "8",
      "name": "Wait 4 Days",
      "type": "n8n-nodes-base.wait",
      "parameters": {
        "amount": 4,
        "unit": "days"
      }
    },
    {
      "id": "9",
      "name": "Day 7 Marketing Rule",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.contact_email }}",
        "subject": "=SEC Marketing Rule \u00a7275.206(4)-1 \u2014 performance advertising compliance",
        "message": "=Day 7 update.\n\nSEC Marketing Rule (17 CFR \u00a7275.206(4)-1) requires all performance advertising to show both gross and net returns, with equal prominence. Key requirements:\n\n\u2022 Gross AND net returns required (net = after fees)\n\u2022 Related benchmark required for all performance presentations\n\u2022 Predecessor performance: specific attribution conditions apply\n\u2022 Hypothetical performance: additional safeguards required\n\u2022 Past performance disclaimer mandatory\n\nFlowKit's Marketing Rule validator (Workflow 4) checks all performance submissions in your platform for these fields automatically.\n\nYour compliance review contact: {{ $json.compliance_email }}"
      }
    }
  ],
  "connections": {
    "New RIA Account in Sheets": {
      "main": [
        [
          {
            "node": "Classify RIA Tier & Flags",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify RIA Tier & Flags": {
      "main": [
        [
          {
            "node": "Day 0 Welcome + Compliance Kit",
            "type": "main",
            "index": 0
          },
          {
            "node": "Slack CSM Channel",
            "type": "main",
            "index": 0
          },
          {
            "node": "Audit Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Day 0 Welcome + Compliance Kit": {
      "main": [
        [
          {
            "node": "Wait 3 Days",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 3 Days": {
      "main": [
        [
          {
            "node": "Day 3 ADV Checklist",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Day 3 ADV Checklist": {
      "main": [
        [
          {
            "node": "Wait 4 Days",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 4 Days": {
      "main": [
        [
          {
            "node": "Day 7 Marketing Rule",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 2: RIA Compliance Deadline Tracker (ADV / Custody / GIPS / TRACE / Form PF)

Runs weekdays at 8AM. Reads a Google Sheet with 12 deadline types, calculates urgency (OVERDUE/CRITICAL/URGENT/WARNING), deduplicates alerts using $getWorkflowStaticData so you don't get the same alert 20 times in a day, routes CRITICAL/OVERDUE to #ria-compliance-critical with @here plus email to the firm compliance lead, routes URGENT/WARNING to #ria-compliance.

The 12 deadline types:

SEC_ADV_PART2A_ANNUAL_90DAY — Advisers Act Rule 204-1(a): 90 days after fiscal year end
SEC_ADV_PART2A_MATERIAL_AMENDMENT — Advisers Act Rule 204-1(b): 30 days after material change
SEC_CUSTODY_RULE_SURPRISE_EXAM_NOTICE — Rule 206(4)-2: surprise exam notice within 120 days of FYE
GIPS_COMPOSITE_ANNUAL_REPORT — GIPS 2020 §1.A.4: all compliant composites need 5yr track record or since inception
GIPS_VERIFICATION_ENGAGEMENT — GIPS 2020 §8.A.1: voluntary annual GIPS verification
FINRA_TRACE_REPORTING_AUDIT — FINRA Rule 6730: bond trade reporting within 15 minutes of execution
FORM_PF_QUARTERLY_SMALL_ADVISER — SEC Rule 204(b)-1: Form PF Section 1 within 60 days of quarter end (AUM <$1.5B)
FORM_PF_ANNUAL_SMALL_ADVISER — annual Form PF within 120 days of FYE (AUM $150M–$1.5B)
CFTC_NFA_MEMBERSHIP_RENEWAL — 7 USC §6m + NFA Compliance Rule 2-36: annual NFA dues and registration
SEC_MARKETING_RULE_ANNUAL_REVIEW — Rule 275.206(4)-1: annual review of all performance advertising materials
SOC2_TYPE2_RENEWAL — annual SOC 2 Type II audit
SEC_FORM_ADV_ITEM_8_DISCIPLINARY — Form ADV Item 8: annual disciplinary history review

{
  "name": "RIA Compliance Deadline Tracker (ADV / Custody / GIPS / TRACE / Form PF)",
  "nodes": [
    {
      "id": "1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "read",
        "sheetId": "YOUR_SHEET_ID",
        "range": "RIA_Deadlines!A:J"
      }
    },
    {
      "id": "3",
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const items = $input.all();\nconst now = new Date();\nconst state = $getWorkflowStaticData('global');\nstate.alerted = state.alerted || {};\nconst DEADLINE_MAP = {\n  'SEC_ADV_PART2A_ANNUAL_90DAY': 'Advisers Act Rule 204-1(a) \u2014 90 days after fiscal year end',\n  'SEC_ADV_PART2A_MATERIAL_AMENDMENT': 'Advisers Act Rule 204-1(b) \u2014 30 days after material change',\n  'SEC_CUSTODY_RULE_SURPRISE_EXAM_NOTICE': 'SEC Rule 206(4)-2 \u00a7275.206(4)-2 \u2014 surprise exam notice within 120 days of FYE',\n  'GIPS_COMPOSITE_ANNUAL_REPORT': 'GIPS 2020 \u00a71.A.4 \u2014 all compliant composites must have 5yr track record or since inception',\n  'GIPS_VERIFICATION_ENGAGEMENT': 'GIPS 2020 \u00a78.A.1 \u2014 voluntary annual GIPS verification',\n  'FINRA_TRACE_REPORTING_AUDIT': 'FINRA Rule 6730 TRACE \u2014 bond trade reporting within 15min of execution',\n  'FORM_PF_QUARTERLY_SMALL_ADVISER': 'SEC Rule 204(b)-1 \u00a7275.204(b)-1 \u2014 Form PF Section 1 within 60 days of quarter end (AUM <$1.5B)',\n  'FORM_PF_ANNUAL_SMALL_ADVISER': 'SEC Rule 204(b)-1 \u2014 Form PF annual (AUM $150M-$1.5B) within 120 days of FYE',\n  'CFTC_NFA_MEMBERSHIP_RENEWAL': 'CFTC 7 USC \u00a76m + NFA Compliance Rule 2-36 \u2014 annual NFA dues and registration renewal',\n  'SEC_MARKETING_RULE_ANNUAL_REVIEW': 'SEC Rule 206(4)-1 \u00a7275.206(4)-1 \u2014 annual review of performance advertising materials',\n  'SOC2_TYPE2_RENEWAL': 'SOC 2 Type II annual audit \u2014 access controls, availability, confidentiality',\n  'SEC_FORM_ADV_ITEM_8_DISCIPLINARY': 'Form ADV Item 8 \u2014 disciplinary history annual review and update'\n};\nconst alerts = [];\nfor (const item of items) {\n  const row = item.json;\n  if (!row['deadline_type'] || !row['deadline_date']) continue;\n  const deadline = new Date(row['deadline_date']);\n  const days = Math.ceil((deadline - now) / 86400000);\n  const bucket = days <= 0 ? 'OVERDUE' : days <= 14 ? 'CRITICAL' : days <= 45 ? 'URGENT' : days <= 90 ? 'WARNING' : null;\n  if (!bucket) continue;\n  const key = row['deadline_type'] + '_' + row['deadline_date'];\n  const lastAlert = state.alerted[key] ? new Date(state.alerted[key]) : null;\n  const hoursSince = lastAlert ? (now - lastAlert) / 3600000 : 999;\n  if (hoursSince < 20) continue;\n  state.alerted[key] = now.toISOString();\n  alerts.push({json: {...row, days_remaining: days, urgency: bucket,\n    regulatory_cite: DEADLINE_MAP[row['deadline_type']] || row['deadline_type']}});\n}\nreturn alerts;"
      }
    },
    {
      "id": "4",
      "name": "Route CRITICAL/OVERDUE",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "conditions": [
            {
              "leftValue": "={{ $json.urgency }}",
              "rightValue": "CRITICAL",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            },
            {
              "leftValue": "={{ $json.urgency }}",
              "rightValue": "OVERDUE",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ],
          "combinator": "or"
        }
      }
    },
    {
      "id": "5",
      "name": "Slack #ria-compliance-critical @here",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#ria-compliance-critical",
        "text": "=\ud83d\udea8 {{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.days_remaining }} days\nCite: {{ $json.regulatory_cite }}\nFirm: {{ $json.firm_name }} | Owner: {{ $json.owner_name }}"
      }
    },
    {
      "id": "6",
      "name": "Gmail Firm Compliance Lead",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.compliance_email }}",
        "subject": "={{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.days_remaining }} days remaining",
        "message": "=RIA compliance deadline alert.\n\nDeadline: {{ $json.deadline_type }}\nStatus: {{ $json.urgency }} ({{ $json.days_remaining }} days)\nRegulatory cite: {{ $json.regulatory_cite }}\nFirm: {{ $json.firm_name }}\n\nAction required by: {{ $json.deadline_date }}\nAssigned owner: {{ $json.owner_name }}\n\nPlatform tracker: YOUR_SHEET_URL"
      }
    },
    {
      "id": "7",
      "name": "Slack #ria-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#ria-compliance",
        "text": "=\u26a0\ufe0f {{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.days_remaining }} days. {{ $json.regulatory_cite }}"
      }
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          {
            "node": "Fetch Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Deadlines": {
      "main": [
        [
          {
            "node": "Classify Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Urgency": {
      "main": [
        [
          {
            "node": "Route CRITICAL/OVERDUE",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route CRITICAL/OVERDUE": {
      "main": [
        [
          {
            "node": "Slack #ria-compliance-critical @here",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Slack #ria-compliance",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack #ria-compliance-critical @here": {
      "main": [
        [
          {
            "node": "Gmail Firm Compliance Lead",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 3: GIPS 2020 Composite Construction Monitor

Runs hourly. Queries your composite database for 5 GIPS 2020 violations:

GIPS_MISSING_NET_RETURN — GIPS 2020 §2.A.35: net returns required for all composites since 2006. Zapier angle: your composite net return data flows through Zapier's shared task log, visible to all workspace members — your GIPS verifier will ask who has access to performance data.
GIPS_NO_BENCHMARK_ASSIGNED — GIPS 2020 §2.A.32: benchmark required or written explanation documented.
GIPS_UNASSIGNED_ACTIVE_ACCOUNTS — GIPS 2020 §3.A.4: all actual fee-paying discretionary accounts must be in at least one composite.
GIPS_LARGE_EXTERNAL_CASH_FLOW — GIPS 2020 §3.A.5: large external cash flows (≥10%) require documented temporary removal policy.
GIPS_STALE_PERFORMANCE_DATA — GIPS 2020 §1.A.4: performance must be updated at minimum annually (>35 days stale = flag).

Uses $getWorkflowStaticData to dedup — only alerts when the violation set changes, not on every hourly run. Logs confirmed violations to Postgres gips_violations table with ON CONFLICT DO NOTHING.

{
  "name": "GIPS 2020 Composite Construction Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Every Hour",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "hoursInterval": 1
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Previous GIPS State",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const state = $getWorkflowStaticData('global');\nreturn [{json: {prev_errors: state.gips_errors || {}, last_run: state.gips_last_run || null}}];"
      }
    },
    {
      "id": "3",
      "name": "Query GIPS Composites",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT\n  c.composite_id, c.composite_name, c.composite_strategy,\n  c.benchmark_ticker, c.inception_date,\n  COUNT(DISTINCT a.account_id) as account_count,\n  MIN(a.performance_inception) as earliest_account_inception,\n  MAX(a.last_performance_date) as latest_data_date,\n  SUM(CASE WHEN a.composite_id IS NULL AND a.account_status = 'ACTIVE' THEN 1 ELSE 0 END) as unassigned_active_accounts,\n  AVG(p.gross_return_pct) as avg_gross_return,\n  AVG(p.net_return_pct) as avg_net_return,\n  COUNT(CASE WHEN p.net_return_pct IS NULL AND p.gross_return_pct IS NOT NULL THEN 1 END) as missing_net_returns,\n  COUNT(CASE WHEN p.cash_flow_pct >= 10 THEN 1 END) as large_cash_flows\nFROM composites c\nLEFT JOIN portfolio_accounts a ON a.composite_id = c.composite_id\nLEFT JOIN performance_records p ON p.composite_id = c.composite_id AND p.period_end >= NOW() - INTERVAL '90 days'\nWHERE c.gips_compliant = TRUE AND c.composite_status = 'ACTIVE'\nGROUP BY c.composite_id, c.composite_name, c.composite_strategy, c.benchmark_ticker, c.inception_date"
      }
    },
    {
      "id": "4",
      "name": "Detect GIPS Violations",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const items = $input.all();\nconst now = new Date();\nconst state = $getWorkflowStaticData('global');\nstate.gips_errors = state.gips_errors || {};\nstate.gips_last_run = now.toISOString();\nconst violations = [];\nfor (const item of items) {\n  const c = item.json;\n  const errors = [];\n  if (c.missing_net_returns > 0) {\n    errors.push({type: 'GIPS_MISSING_NET_RETURN', cite: 'GIPS 2020 \u00a72.A.35 \u2014 net returns required for all composites since 2006', count: c.missing_net_returns});\n  }\n  if (!c.benchmark_ticker) {\n    errors.push({type: 'GIPS_NO_BENCHMARK_ASSIGNED', cite: 'GIPS 2020 \u00a72.A.32 \u2014 benchmark required or rationale documented'});\n  }\n  if (c.unassigned_active_accounts > 0) {\n    errors.push({type: 'GIPS_UNASSIGNED_ACTIVE_ACCOUNTS', cite: 'GIPS 2020 \u00a73.A.4 \u2014 all actual fee-paying discretionary accounts must be included in at least one composite', count: c.unassigned_active_accounts});\n  }\n  if (c.large_cash_flows > 0) {\n    errors.push({type: 'GIPS_LARGE_EXTERNAL_CASH_FLOW', cite: 'GIPS 2020 \u00a73.A.5 \u2014 large external cash flows require temporary removal policy', count: c.large_cash_flows});\n  }\n  const daysSinceData = (now - new Date(c.latest_data_date)) / 86400000;\n  if (daysSinceData > 35) {\n    errors.push({type: 'GIPS_STALE_PERFORMANCE_DATA', cite: 'GIPS 2020 \u00a71.A.4 \u2014 performance must be updated at minimum annually', days_stale: Math.floor(daysSinceData)});\n  }\n  if (errors.length === 0) continue;\n  const key = c.composite_id + '_' + errors.map(e => e.type).join('_');\n  const prev = state.gips_errors[c.composite_id] || null;\n  if (prev === key) continue;\n  state.gips_errors[c.composite_id] = key;\n  violations.push({json: {...c, errors, error_count: errors.length, ts: now.toISOString()}});\n}\nreturn violations;"
      }
    },
    {
      "id": "5",
      "name": "Slack #compliance-gips",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#compliance-gips",
        "text": "=\ud83c\udfc6 GIPS Violation: {{ $json.composite_name }} ({{ $json.composite_strategy }})\n{{ $json.errors.map(e => `\u2022 ${e.type}: ${e.cite}`).join('\\n') }}\nComposite ID: {{ $json.composite_id }} | Accounts: {{ $json.account_count }}"
      }
    },
    {
      "id": "6",
      "name": "Log GIPS Violation",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO gips_violations (composite_id, composite_name, errors_json, detected_ts) VALUES ('{{ $json.composite_id }}', '{{ $json.composite_name }}', '{{ JSON.stringify($json.errors) }}', NOW()) ON CONFLICT (composite_id, detected_ts::date) DO NOTHING"
      }
    }
  ],
  "connections": {
    "Every Hour": {
      "main": [
        [
          {
            "node": "Fetch Previous GIPS State",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Previous GIPS State": {
      "main": [
        [
          {
            "node": "Query GIPS Composites",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query GIPS Composites": {
      "main": [
        [
          {
            "node": "Detect GIPS Violations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Detect GIPS Violations": {
      "main": [
        [
          {
            "node": "Slack #compliance-gips",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack #compliance-gips": {
      "main": [
        [
          {
            "node": "Log GIPS Violation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 4: SEC Marketing Rule Performance Claim Validator

Webhook triggered when a client submits performance advertising materials through your platform. Validates 7 SEC Rule 275.206(4)-1 requirements in real time:

Gross + Net returns (equal prominence) — §275.206(4)-1(d)(1)
Benchmark (required or written rationale) — §275.206(4)-1(d)(2)
1-, 5-, 10-year periods (or since inception) — §275.206(4)-1(d)(3)
Past performance disclaimer — §275.206(4)-1(d)(5)(ii)
Inception date — §275.206(4)-1(d)(6)
Hypothetical performance legend — §275.206(4)-1(d)(7)(i): must state results achieved with benefit of hindsight and cannot be replicated
Testimonial compensation disclosure — §275.206(4)-1(b)(1)(ii)

CRITICAL violations get immediately blocked (HTTP 422 back to the submitter), routed to #compliance-marketing with @here, and the submitter receives a detailed email listing each violation and the regulatory cite. Compliant submissions get HTTP 200. All results logged to Postgres with ON CONFLICT DO NOTHING.

Why self-hosted matters: during an OCIE examination, the SEC can request your performance advertising review records. Zapier's 30-day log retention means your audit trail is gone before the exam starts. Your n8n Postgres log is permanent.

{
  "name": "SEC Marketing Rule Performance Claim Validator",
  "nodes": [
    {
      "id": "1",
      "name": "Webhook: Performance Material Submitted",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "marketing-rule-validate",
        "responseMode": "responseNode",
        "method": "POST"
      }
    },
    {
      "id": "2",
      "name": "Validate SEC 275.206(4)-1 Requirements",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst violations = [];\nconst now = new Date();\n\n// GIPS 2020 / SEC Marketing Rule \u00a7275.206(4)-1 checks\nif (d.includes_performance) {\n  // Gross + Net both required\n  if (d.gross_return !== undefined && d.net_return === undefined) {\n    violations.push({type: 'MISSING_NET_RETURN', severity: 'CRITICAL',\n      cite: 'SEC Rule 275.206(4)-1(d)(1) \u2014 net return required with equal prominence whenever gross return shown',\n      deadline_hours: 1});\n  }\n  if (d.net_return !== undefined && d.gross_return === undefined) {\n    violations.push({type: 'MISSING_GROSS_RETURN', severity: 'HIGH',\n      cite: 'SEC Rule 275.206(4)-1(d)(1) \u2014 gross return must accompany net return',\n      deadline_hours: 2});\n  }\n  // Benchmark required\n  if (!d.benchmark_name) {\n    violations.push({type: 'MISSING_BENCHMARK', severity: 'CRITICAL',\n      cite: 'SEC Rule 275.206(4)-1(d)(2) \u2014 benchmark required or written explanation why no appropriate benchmark exists',\n      deadline_hours: 1});\n  }\n  // Past performance disclaimer\n  if (!d.past_performance_disclaimer) {\n    violations.push({type: 'MISSING_PAST_PERFORMANCE_DISCLAIMER', severity: 'HIGH',\n      cite: 'SEC Rule 275.206(4)-1(d)(5)(ii) \u2014 past performance does not guarantee future results disclaimer required',\n      deadline_hours: 2});\n  }\n  // Inception date\n  if (!d.performance_inception_date) {\n    violations.push({type: 'MISSING_INCEPTION_DATE', severity: 'HIGH',\n      cite: 'SEC Rule 275.206(4)-1(d)(6) \u2014 inception date required for all performance presentations',\n      deadline_hours: 2});\n  }\n  // Hypothetical performance additional safeguards\n  if (d.is_hypothetical_performance && !d.hypothetical_performance_legend) {\n    violations.push({type: 'MISSING_HYPOTHETICAL_LEGEND', severity: 'CRITICAL',\n      cite: 'SEC Rule 275.206(4)-1(d)(7)(i) \u2014 prominent legend: results were achieved with benefit of hindsight; cannot be replicated',\n      deadline_hours: 1});\n  }\n  // 1-, 5-, 10-year periods\n  if (d.includes_track_record && (!d.period_1yr || !d.period_5yr)) {\n    violations.push({type: 'MISSING_REQUIRED_PERIODS', severity: 'HIGH',\n      cite: 'SEC Rule 275.206(4)-1(d)(3) \u2014 1-, 5-, and 10-year (or since inception) periods required',\n      deadline_hours: 4});\n  }\n}\n// Testimonial compliance\nif (d.includes_testimonial) {\n  if (!d.testimonial_disclosure_compensation) {\n    violations.push({type: 'MISSING_TESTIMONIAL_COMPENSATION_DISCLOSURE', severity: 'HIGH',\n      cite: 'SEC Rule 275.206(4)-1(b)(1)(ii) \u2014 must disclose if testimonial provider was compensated',\n      deadline_hours: 4});\n  }\n}\nconst severity = violations.some(v => v.severity === 'CRITICAL') ? 'CRITICAL' :\n                 violations.some(v => v.severity === 'HIGH') ? 'HIGH' : 'PASS';\nreturn [{json: {\n  material_id: d.material_id,\n  submitter_email: d.submitter_email,\n  firm_name: d.firm_name,\n  violations,\n  severity,\n  violation_count: violations.length,\n  ts: now.toISOString(),\n  compliant: violations.length === 0\n}}];"
      }
    },
    {
      "id": "3",
      "name": "Route CRITICAL Violations",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "conditions": [
            {
              "leftValue": "={{ $json.severity }}",
              "rightValue": "CRITICAL",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ]
        }
      }
    },
    {
      "id": "4",
      "name": "Slack #compliance-marketing CRITICAL @here",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#compliance-marketing",
        "text": "=\ud83d\udea8 SEC MARKETING RULE VIOLATION: {{ $json.firm_name }} ({{ $json.material_id }})\n{{ $json.violations.map(v => `\u2022 ${v.type}: ${v.cite}`).join('\\n') }}\nSubmitter: {{ $json.submitter_email }}"
      }
    },
    {
      "id": "5",
      "name": "Block Submission + Notify",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.submitter_email }}",
        "subject": "=SEC Marketing Rule Violation: material {{ $json.material_id }} blocked",
        "message": "=Your performance marketing material (ID: {{ $json.material_id }}) has been blocked pending compliance review.\n\nViolations found ({{ $json.violation_count }}):\n{{ $json.violations.map(v => `\u2022 ${v.type}: ${v.cite}`).join('\\n') }}\n\nSEC Rule 275.206(4)-1 prohibits distribution of non-compliant performance advertising. Please correct and resubmit.\n\nCompliance team: {{ $json.compliance_contact }}"
      }
    },
    {
      "id": "6",
      "name": "Log Violation",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO marketing_violations (material_id, firm_name, severity, violations_json, detected_ts) VALUES ('{{ $json.material_id }}', '{{ $json.firm_name }}', '{{ $json.severity }}', '{{ JSON.stringify($json.violations) }}', NOW()) ON CONFLICT DO NOTHING"
      }
    },
    {
      "id": "7",
      "name": "Respond 200 Compliant",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "responseCode": 200,
        "responseBody": "={ \"status\": \"compliant\", \"material_id\": \"{{ $json.material_id }}\", \"ts\": \"{{ $json.ts }}\" }"
      }
    },
    {
      "id": "8",
      "name": "Respond 422 Violation",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "responseCode": 422,
        "responseBody": "={ \"status\": \"blocked\", \"violation_count\": {{ $json.violation_count }}, \"violations\": {{ JSON.stringify($json.violations) }}, \"material_id\": \"{{ $json.material_id }}\" }"
      }
    }
  ],
  "connections": {
    "Webhook: Performance Material Submitted": {
      "main": [
        [
          {
            "node": "Validate SEC 275.206(4)-1 Requirements",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Validate SEC 275.206(4)-1 Requirements": {
      "main": [
        [
          {
            "node": "Route CRITICAL Violations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route CRITICAL Violations": {
      "main": [
        [
          {
            "node": "Slack #compliance-marketing CRITICAL @here",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond 200 Compliant",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack #compliance-marketing CRITICAL @here": {
      "main": [
        [
          {
            "node": "Block Submission + Notify",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Block Submission + Notify": {
      "main": [
        [
          {
            "node": "Log Violation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Log Violation": {
      "main": [
        [
          {
            "node": "Respond 422 Violation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 5: Weekly WealthTech Platform KPI Dashboard

Fires Monday at 8AM. Two parallel Postgres queries (platform metrics + compliance debt), merged and processed. Calculates WoW AUM change using $getWorkflowStaticData. Builds a color-coded HTML report (green ≥2% AUM growth, orange ≥0%, red <0%) with a compliance debt table broken down by ADV, Custody, Form PF, GIPS, and Marketing Rule open items. Sends to CEO with BCC to CCO, CFO, CTO. Posts summary to #exec-kpis.

{
  "name": "Weekly WealthTech Platform KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Platform Metrics",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(DISTINCT firm_id) as active_firms, SUM(aum_usd) as total_aum, COUNT(CASE WHEN created_at >= NOW() - INTERVAL '7 days' THEN 1 END) as new_firms_7d, COUNT(CASE WHEN tier = 'ENTERPRISE_RIA_PLATFORM' THEN 1 END) as enterprise_count, COUNT(CASE WHEN tier = 'HEDGE_FUND_SAAS' THEN 1 END) as hedge_fund_count FROM ria_onboarding_audit WHERE account_status = 'ACTIVE'"
      }
    },
    {
      "id": "3",
      "name": "Fetch Compliance Debt",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(CASE WHEN urgency = 'OVERDUE' THEN 1 END) as overdue_deadlines, COUNT(CASE WHEN urgency = 'CRITICAL' THEN 1 END) as critical_deadlines, COUNT(CASE WHEN deadline_type LIKE 'SEC_ADV%' AND urgency IN ('OVERDUE','CRITICAL') THEN 1 END) as adv_critical, COUNT(CASE WHEN deadline_type LIKE 'SEC_CUSTODY%' AND urgency IN ('OVERDUE','CRITICAL') THEN 1 END) as custody_critical, COUNT(CASE WHEN deadline_type LIKE 'FORM_PF%' AND urgency IN ('OVERDUE','CRITICAL') THEN 1 END) as form_pf_critical, COUNT(CASE WHEN deadline_type LIKE 'GIPS%' AND urgency IN ('OVERDUE','CRITICAL') THEN 1 END) as gips_critical, COUNT(CASE WHEN deadline_type = 'SEC_MARKETING_RULE_ANNUAL_REVIEW' AND urgency IN ('OVERDUE','CRITICAL') THEN 1 END) as marketing_rule_critical FROM compliance_deadlines_tracker WHERE deadline_date >= NOW() - INTERVAL '30 days'"
      }
    },
    {
      "id": "4",
      "name": "Merge Metrics",
      "type": "n8n-nodes-base.merge",
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByPosition"
      }
    },
    {
      "id": "5",
      "name": "Build WoW % & HTML",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst state = $getWorkflowStaticData('global');\nconst prev = state.weekly_kpi || {};\nconst wowAUM = prev.total_aum ? ((d.total_aum - prev.total_aum) / prev.total_aum * 100).toFixed(1) : 'N/A';\nstate.weekly_kpi = d;\nconst color = c => parseFloat(c) >= 2 ? '#27ae60' : parseFloat(c) >= 0 ? '#f39c12' : '#e74c3c';\nconst html = `<h2 style=\"font-family:sans-serif\">WealthTech Platform \u2014 Weekly KPI Report</h2>\n<table style=\"font-family:sans-serif;border-collapse:collapse;width:600px\">\n<tr style=\"background:#1a1a2e;color:white\"><th style=\"padding:10px\">Metric</th><th>This Week</th><th>WoW</th></tr>\n<tr><td style=\"padding:8px\">Total Client AUM</td><td>$${(d.total_aum/1e9).toFixed(1)}B</td><td style=\"color:${color(wowAUM)}\">${wowAUM}%</td></tr>\n<tr><td style=\"padding:8px\">Active RIA Firms</td><td>${d.active_firms}</td><td>+${d.new_firms_7d} this week</td></tr>\n<tr><td style=\"padding:8px\">Enterprise RIA Platforms</td><td>${d.enterprise_count}</td><td></td></tr>\n<tr><td style=\"padding:8px\">Hedge Fund SaaS Clients</td><td>${d.hedge_fund_count}</td><td></td></tr>\n</table>\n<h3 style=\"font-family:sans-serif;color:#e74c3c\">Compliance Debt</h3>\n<table style=\"font-family:sans-serif;border-collapse:collapse;width:600px\">\n<tr style=\"background:#c0392b;color:white\"><th style=\"padding:10px\">Deadline Type</th><th>OVERDUE</th><th>CRITICAL</th></tr>\n<tr><td style=\"padding:8px\">Form ADV Part 2A</td><td style=\"color:${d.adv_critical > 0 ? '#e74c3c' : '#27ae60'}\">${d.adv_critical}</td><td></td></tr>\n<tr><td style=\"padding:8px\">SEC Custody Rule</td><td style=\"color:${d.custody_critical > 0 ? '#e74c3c' : '#27ae60'}\">${d.custody_critical}</td><td></td></tr>\n<tr><td style=\"padding:8px\">Form PF</td><td style=\"color:${d.form_pf_critical > 0 ? '#e74c3c' : '#27ae60'}\">${d.form_pf_critical}</td><td></td></tr>\n<tr><td style=\"padding:8px\">GIPS Composite</td><td style=\"color:${d.gips_critical > 0 ? '#e74c3c' : '#27ae60'}\">${d.gips_critical}</td><td></td></tr>\n<tr><td style=\"padding:8px\">Marketing Rule</td><td style=\"color:${d.marketing_rule_critical > 0 ? '#e74c3c' : '#27ae60'}\">${d.marketing_rule_critical}</td><td></td></tr>\n<tr style=\"background:#2c3e50;color:white\"><td style=\"padding:8px\"><b>TOTAL OPEN</b></td><td>${d.overdue_deadlines}</td><td>${d.critical_deadlines}</td></tr>\n</table>`;\nreturn [{json: {...d, html, wow_aum: wowAUM}}];"
      }
    },
    {
      "id": "6",
      "name": "Gmail CEO BCC CCO/CFO/CTO",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "ceo@your-wealthtech.com",
        "bccList": "cco@your-wealthtech.com,cfo@your-wealthtech.com,cto@your-wealthtech.com",
        "subject": "=WealthTech Weekly KPI \u2014 {{ $now.toFormat('yyyy-MM-dd') }} | AUM {{ $json.total_aum_b }}B | {{ $json.overdue_deadlines + $json.critical_deadlines }} compliance open",
        "message": "={{ $json.html }}"
      }
    },
    {
      "id": "7",
      "name": "Slack #exec-kpis",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#exec-kpis",
        "text": "=\ud83d\udcca WealthTech Weekly KPI\nActive Firms: {{ $json.active_firms }} | Total AUM: ${{ ($json.total_aum/1e9).toFixed(1) }}B ({{ $json.wow_aum }}% WoW)\nCompliance Debt: {{ $json.overdue_deadlines }} OVERDUE / {{ $json.critical_deadlines }} CRITICAL\nADV={{ $json.adv_critical }} | Custody={{ $json.custody_critical }} | FormPF={{ $json.form_pf_critical }} | GIPS={{ $json.gips_critical }} | MktRule={{ $json.marketing_rule_critical }}"
      }
    }
  ],
  "connections": {
    "Monday 8AM": {
      "main": [
        [
          {
            "node": "Fetch Platform Metrics",
            "type": "main",
            "index": 0
          },
          {
            "node": "Fetch Compliance Debt",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Platform Metrics": {
      "main": [
        [
          {
            "node": "Merge Metrics",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Compliance Debt": {
      "main": [
        [
          {
            "node": "Merge Metrics",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge Metrics": {
      "main": [
        [
          {
            "node": "Build WoW % & HTML",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build WoW % & HTML": {
      "main": [
        [
          {
            "node": "Gmail CEO BCC CCO/CFO/CTO",
            "type": "main",
            "index": 0
          },
          {
            "node": "Slack #exec-kpis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Why Self-Hosted n8n for WealthTech/RIA Compliance

Risk	Zapier / cloud iPaaS	Self-hosted n8n
SEC Reg S-P §248.3 — client investment strategy data through Zapier's multi-tenant cloud = undocumented third-party disclosure	ADV Part 2A strategy descriptions in Zapier task log	Data stays in your Postgres, never leaves your network
GIPS 2020 §1.A.4 — composite performance data visible to all Zapier workspace members	GIPS verifier asks who has access to performance data	Postgres access-controlled, git-versioned
FINRA Rule 6730 TRACE — 15-minute bond trade reporting clock	Zapier webhook failure = late TRACE report = fines up to $1M/violation	Local n8n, no external dependency on Zapier uptime
SEC Rule 275.206(4)-1 — Marketing Rule audit trail for OCIE examinations	Zapier 30-day log deletion before exam	Permanent Postgres log, survives OCIE 3-5yr lookback
Form PF Rule 275.204(b)-1 — fund strategy/position data is SEC confidential supervisory information	Routes through Zapier's multi-tenant cloud	Air-gapped or VPC-isolated n8n, zero external exposure
Compliance circularity — running your SEC ADV tracker on a non-compliant tool	Zapier itself appears in your vendor inventory and ADV Part 2A §7.B(1) disclosure	n8n: self-hosted, git-versioned, SOC 2 Type II attestable

Cost comparison: 10M portfolio events/month on Zapier ≈ $50K/year. Self-hosted n8n on a $300/month VPS: $3,600/year (93% reduction). For a Series B WealthTech company with 50 RIA clients, that gap is meaningful.

Deployment

# Docker Compose
version: '3.8'
services:
  n8n:
    image: n8nio/n8n:latest
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=your_secure_password
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
    volumes:
      - n8n_data:/home/node/.n8n
    ports:
      - '5678:5678'

Import a workflow: Settings → Import from File → paste any of the JSON objects above.

Where to Get the Templates

All 5 workflows are available as ready-to-import packages (with Google Sheets templates, Postgres DDL, and documentation) at FlowKit on Gumroad.

If you found this useful, follow @flowkithq for the next installment: n8n for HealthTech/RPM SaaS — HIPAA BAA, ONC TEFCA, FDA SaMD, and CMS Interoperability.

n8n for EnergyTech/CleanTech SaaS: 5 Automations for NERC CIP, FERC Order 2222, EPA, and SEC Climate Disclosure

Alex Kane — Fri, 29 May 2026 00:03:32 +0000

EnergyTech and CleanTech SaaS vendors sit at the intersection of three converging regulatory stacks: grid reliability (NERC CIP), emissions compliance (EPA Clean Air Act), and climate financial disclosure (SEC Rule 33-11275). Each fires on different clocks, with different enforcement bodies, and different evidence standards.

A NERC CIP cyber incident requires E-ISAC notification within 1 hour of detection (CIP-008-6 R4.1). An EPA §111(d) emission exceedance is immediate — the compliance manager must act before the agency audit. A SEC material climate event triggers a 4 business-day 8-K under 17 CFR §229.1502. These are not the same clock, and they cannot be managed from the same incident queue.

This article shows 5 n8n workflows for EnergyTech and CleanTech SaaS vendors — grid management platforms, renewable energy SaaS, utility billing tools, energy trading platforms, demand response SaaS, building energy management vendors, and CleanTech startups.

The regulatory stack

NERC CIP v7 — BES Cyber System protection
The North American Electric Reliability Corporation Critical Infrastructure Protection standards (CIP-001 through CIP-014) govern cybersecurity for Bulk Electric System (BES) assets. Key clocks: CIP-004-6 annual personnel training (R4.2), CIP-007-6 35-day patch window (R2), CIP-008-6 15-month incident response exercise (R3), and CIP-009-6 annual recovery plan review (R3). CIP-008-6 R4.1 requires reporting a BES Cyber Security Incident to E-ISAC and NERC Compliance within 1 hour of confirmation. SaaS vendors whose platforms touch BES cyber assets must document whether their automation tooling is within the CIP compliance boundary. A cloud iPaaS vendor routing CJI through a shared multi-tenant pipeline is not within that boundary.

FERC Order 2222 — Distributed Energy Resource aggregation
FERC Order 2222 (2020) requires all RTOs and ISOs to revise their tariffs to allow DER aggregators to participate in all wholesale electric markets. EnergyTech platforms that aggregate distributed solar, batteries, demand response, or EV charging into market-participating resources must track interconnection queue deadlines, capacity market eligibility windows, and the FERC Order 2023 interconnection reform milestones.

EPA Clean Air Act §111(d) — Carbon Pollution Standard
EPA's 2024 Carbon Pollution Standard for existing power plants sets emission limits for coal and gas generators under CAA §111(d). CleanTech SaaS platforms serving power generators must track annual compliance reporting windows, Title V permit renewal deadlines, and emission monitoring system (CEMS) calibration certificates.

SEC Climate Rule — 17 CFR Parts 210, 229, 232, 239
SEC's climate disclosure rule (adopted March 2024, currently subject to litigation stay) requires large accelerated filers to disclose Scope 1 and 2 GHG emissions, material physical and transition climate risks, and climate-related financial impacts in annual 10-K filings. Material climate events — grid disruptions, flood damage to a major facility, regulatory action on a major emission source — may trigger a 4 business-day 8-K under §229.1502.

CA SB 100 — 100% clean electricity by 2045
California SB 100 (§454.53 of the Public Utilities Code) requires 100% of California retail electricity to come from renewable and zero-carbon sources by 2045, with a 60% renewable portfolio standard by 2030. CleanTech platforms serving California utilities must track annual procurement compliance reports to the CPUC.

The 7 customer tiers

Tier	Example platforms
`GRID_MGMT_SAAS`	BES monitoring, SCADA integration, EMS platforms
`RENEWABLE_ENERGY_SAAS`	Solar/wind asset management, BESS optimization
`UTILITY_BILLING_SAAS`	AMI analytics, rate design, NEM billing
`ENERGY_TRADING_SAAS`	ISO/RTO bidding, capacity market, power purchase agreements
`DEMAND_RESPONSE_SAAS`	DER aggregation, FERC Order 2222, virtual power plants
`BUILDING_ENERGY_SAAS`	ENERGY STAR benchmarking, BMS integration, ASHRAE 90.1
`CLEANTECH_STARTUP_SAAS`	Carbon accounting, green hydrogen, EV fleet management

Workflow 1: NERC CIP v7 BES Cyber Asset Compliance Monitor

This daily workflow queries your BES cyber asset registry for CIP compliance gaps — training expiry (CIP-004-6), open patch windows (CIP-007-6), overdue incident response exercises (CIP-008-6), recovery plan expiry (CIP-009-6), and physical security review overdue (CIP-014-3).

{
  "name": "NERC CIP v7 BES Cyber Asset Compliance Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Daily 7AM Cron",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1-5"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Query BES Cyber Assets",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT asset_id, asset_name, cip_impact_level, cip004_training_expiry, cip007_patch_window_open, cip008_plan_last_tested, cip009_recovery_plan_expiry, cip014_physical_review_due, asset_owner_email FROM bes_cyber_assets WHERE asset_status = 'ACTIVE' AND (cip004_training_expiry <= NOW() + INTERVAL '30 days' OR cip007_patch_window_open = TRUE OR cip008_plan_last_tested <= NOW() - INTERVAL '15 months' OR cip009_recovery_plan_expiry <= NOW() + INTERVAL '60 days' OR cip014_physical_review_due <= NOW() + INTERVAL '30 days')"
      }
    },
    {
      "id": "3",
      "name": "Classify CIP Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const items = $input.all();\nconst results = [];\nconst now = new Date();\nfor (const item of items) {\n  const d = item.json;\n  const alerts = [];\n  const training_exp = new Date(d.cip004_training_expiry);\n  const days_training = Math.ceil((training_exp - now) / 86400000);\n  if (days_training <= 0) alerts.push({type: 'CIP004_TRAINING_EXPIRED', severity: 'CRITICAL', days: days_training, cite: 'CIP-004-6 R4.2 annual training requirement'});\n  else if (days_training <= 14) alerts.push({type: 'CIP004_TRAINING_EXPIRING', severity: 'URGENT', days: days_training, cite: 'CIP-004-6 R4.2'});\n  if (d.cip007_patch_window_open) alerts.push({type: 'CIP007_PATCH_WINDOW_OPEN', severity: 'HIGH', cite: 'CIP-007-6 R2 35-day patch window'});\n  const plan_tested = new Date(d.cip008_plan_last_tested);\n  const months_since_test = (now - plan_tested) / (30 * 86400000);\n  if (months_since_test >= 15) alerts.push({type: 'CIP008_PLAN_OVERDUE', severity: 'CRITICAL', cite: 'CIP-008-6 R3 15-month test requirement'});\n  const recovery_exp = new Date(d.cip009_recovery_plan_expiry);\n  const days_recovery = Math.ceil((recovery_exp - now) / 86400000);\n  if (days_recovery <= 30) alerts.push({type: 'CIP009_RECOVERY_PLAN_EXPIRING', severity: 'HIGH', days: days_recovery, cite: 'CIP-009-6 R3 annual review'});\n  const phys_due = new Date(d.cip014_physical_review_due);\n  const days_phys = Math.ceil((phys_due - now) / 86400000);\n  if (days_phys <= 0) alerts.push({type: 'CIP014_PHYSICAL_REVIEW_OVERDUE', severity: 'CRITICAL', days: days_phys, cite: 'CIP-014-3 R6 annual threat review'});\n  if (alerts.length > 0) results.push({json: {...d, alerts, highest_severity: alerts.some(a => a.severity==='CRITICAL') ? 'CRITICAL' : 'HIGH'}});\n}\nreturn results;"
      }
    },
    {
      "id": "4",
      "name": "Route by Severity",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": false,
            "leftValue": "",
            "typeValidation": "strict"
          },
          "conditions": [
            {
              "id": "1",
              "leftValue": "={{ $json.highest_severity }}",
              "rightValue": "CRITICAL",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ]
        }
      }
    },
    {
      "id": "5",
      "name": "Slack CRITICAL #nerc-compliance-critical",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#nerc-compliance-critical",
        "text": "=\ud83d\udea8 NERC CIP CRITICAL \u2014 {{ $json.asset_name }} ({{ $json.cip_impact_level }})\n{{ $json.alerts.map(a => `\u2022 ${a.type}: ${a.cite}`).join('\\n') }}\nOwner: {{ $json.asset_owner_email }}"
      }
    },
    {
      "id": "6",
      "name": "Gmail Asset Owner",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "={{ $json.asset_owner_email }}",
        "subject": "=NERC CIP CRITICAL: {{ $json.asset_name }} compliance gap",
        "message": "=NERC CIP compliance gap detected for BES Cyber Asset {{ $json.asset_name }} (Impact Level: {{ $json.cip_impact_level }}).\n\nAlerts:\n{{ $json.alerts.map(a => `${a.type}: ${a.cite}`).join('\\n') }}\n\nRemediate within 35 days (CIP-007 patch) or before certification deadline."
      }
    },
    {
      "id": "7",
      "name": "Slack HIGH #nerc-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#nerc-compliance",
        "text": "=\u26a0\ufe0f NERC CIP HIGH \u2014 {{ $json.asset_name }}: {{ $json.alerts.map(a=>a.type).join(', ') }}"
      }
    }
  ],
  "connections": {
    "Daily 7AM Cron": {
      "main": [
        [
          {
            "node": "Query BES Cyber Assets",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query BES Cyber Assets": {
      "main": [
        [
          {
            "node": "Classify CIP Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify CIP Urgency": {
      "main": [
        [
          {
            "node": "Route by Severity",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route by Severity": {
      "main": [
        [
          {
            "node": "Slack CRITICAL #nerc-compliance-critical",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Slack HIGH #nerc-compliance",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack CRITICAL #nerc-compliance-critical": {
      "main": [
        [
          {
            "node": "Gmail Asset Owner",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Why this matters: CIP-008-6 R4.1 requires E-ISAC notification within 1 hour of confirming a BES Cyber Security Incident. If your platform is the system of record for BES cyber events and the incident response plan has not been exercised in 15 months, you are in violation before the clock even starts. This workflow surfaces the 15-month gap before an incident, not after.

Workflow 2: FERC / EPA / SEC CleanTech Compliance Deadline Tracker

Daily tracker for 14 regulatory deadline types: NERC CIP annual recertification, quarterly log review, CIP-008 exercise, FERC Order 2222 compliance filing, FERC Order 2023 interconnection milestones, EPA §111(d) annual report, Title V permit renewal, SEC 10-K climate disclosure, CA SB 100 annual progress, EU Taxonomy KPI reporting, ERCOT interconnection queue, REC retirement, DOE appliance standard review.

{
  "name": "FERC / EPA / SEC CleanTech Compliance Deadline Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Compliance Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "read",
        "sheetId": "YOUR_SHEET_ID",
        "range": "Deadlines!A:H"
      }
    },
    {
      "id": "3",
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const items = $input.all();\nconst now = new Date();\nconst alerts = [];\nconst DEADLINE_TYPES = {\n  'NERC_CIP_ANNUAL_RECERTIFICATION': 'CIP-001 through CIP-014 annual evidence package',\n  'NERC_CIP_QUARTERLY_LOG_REVIEW': 'CIP-007-6 R5.6 quarterly review',\n  'NERC_CIP_008_INCIDENT_EXERCISE': 'CIP-008-6 R3 15-month incident response exercise',\n  'FERC_ORDER_2222_COMPLIANCE_FILING': 'FERC Order 2222 RTO/ISO DER participation rule',\n  'FERC_ORDER_2023_INTERCONNECT': 'FERC Order 2023 generator interconnection queue reform',\n  'EPA_111D_ANNUAL_EMISSION_REPORT': 'CAA \u00a7111(d) Carbon Pollution Standard annual compliance',\n  'EPA_TITLE_V_PERMIT_RENEWAL': 'CAA Title V operating permit renewal',\n  'SEC_CLIMATE_RULE_ANNUAL_10K': 'SEC 17 CFR \u00a7229.1500 climate risk 10-K disclosure',\n  'SEC_CLIMATE_RULE_8K_MATERIAL': '4-business-day 8-K material climate event',\n  'CA_SB100_ANNUAL_PROGRESS_REPORT': 'CA SB 100 \u00a7454.53 100% clean electricity 2045 progress',\n  'EU_TAXONOMY_CLIMATE_MITIGATION_REPORT': 'EU Taxonomy Regulation Art.8 KPI reporting',\n  'ERCOT_INTERCONNECT_QUEUE_UPDATE': 'ERCOT Nodal Protocol \u00a75.2.1 interconnection milestone',\n  'REC_RETIREMENT_ANNUAL': 'Renewable Energy Certificate retirement for RPS compliance',\n  'DOE_EERE_APPLIANCE_STANDARD_REVIEW': 'DOE 10 CFR Part 430/431 appliance efficiency standard'\n};\nfor (const item of items) {\n  const row = item.json;\n  const deadline = new Date(row['deadline_date']);\n  const days = Math.ceil((deadline - now) / 86400000);\n  const dtype = row['deadline_type'];\n  let bucket = days <= 0 ? 'OVERDUE' : days <= 14 ? 'CRITICAL' : days <= 45 ? 'URGENT' : days <= 90 ? 'WARNING' : 'NOTICE';\n  if (bucket !== 'NOTICE') alerts.push({json: {...row, days_remaining: days, urgency: bucket, regulatory_cite: DEADLINE_TYPES[dtype] || dtype}});\n}\nreturn alerts;"
      }
    },
    {
      "id": "4",
      "name": "Route CRITICAL/OVERDUE",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "conditions": [
            {
              "leftValue": "={{ $json.urgency }}",
              "rightValue": "CRITICAL",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            },
            {
              "leftValue": "={{ $json.urgency }}",
              "rightValue": "OVERDUE",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ],
          "combinator": "or"
        }
      }
    },
    {
      "id": "5",
      "name": "Slack + Gmail Critical",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#regulatory-compliance-critical",
        "text": "=\ud83d\udea8 {{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.days_remaining }} days\nCite: {{ $json.regulatory_cite }}\nOwner: {{ $json.owner_name }}"
      }
    },
    {
      "id": "6",
      "name": "Slack Warning/Urgent",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#regulatory-compliance",
        "text": "=\u26a0\ufe0f {{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.days_remaining }} days remaining. Cite: {{ $json.regulatory_cite }}"
      }
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          {
            "node": "Fetch Compliance Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Compliance Deadlines": {
      "main": [
        [
          {
            "node": "Classify Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Urgency": {
      "main": [
        [
          {
            "node": "Route CRITICAL/OVERDUE",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route CRITICAL/OVERDUE": {
      "main": [
        [
          {
            "node": "Slack + Gmail Critical",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Slack Warning/Urgent",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The self-hosting argument: SEC 17 CFR §229.1502 climate disclosure workflows generate evidence that becomes part of the annual report attestation chain. Routing Scope 1/2 emission data through a cloud iPaaS creates a gap between the data as processed and the data as filed — the same gap that triggered restatements in early CSRD pilots. Self-hosted n8n with Postgres audit logs keeps the evidence chain inside your SOX disclosure controls boundary.

Workflow 3: Grid & Clean Energy API Health Monitor

Five-minute polling across grid operations, FERC OASIS, NERC CIP portal, EPA CDX e-reporting, and energy trading APIs. Uses $getWorkflowStaticData for state-change deduplication — only fires an alert when status changes, not on every poll cycle.

{
  "name": "Grid & Clean Energy API Health Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Every 5 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 5
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Previous State",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const state = $getWorkflowStaticData('global');\nreturn [{json: {prev: state.endpoint_status || {}}}];"
      }
    },
    {
      "id": "3",
      "name": "Check Grid Operations API",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://api.your-grid-platform.com/health",
        "method": "GET",
        "timeout": 10000
      }
    },
    {
      "id": "4",
      "name": "Check FERC OASIS API",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://oasis.your-platform.com/health",
        "method": "GET",
        "timeout": 10000
      }
    },
    {
      "id": "5",
      "name": "Check NERC CIP Portal",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://cip.your-platform.com/health",
        "method": "GET",
        "timeout": 10000
      }
    },
    {
      "id": "6",
      "name": "Check EPA e-Reporting API",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://cdx.epa.gov/health",
        "method": "GET",
        "timeout": 10000
      }
    },
    {
      "id": "7",
      "name": "Check Energy Trading API",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://trading.your-platform.com/health",
        "method": "GET",
        "timeout": 10000
      }
    },
    {
      "id": "8",
      "name": "Evaluate & Dedup Alerts",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const prev = $node['Fetch Previous State'].json.prev;\nconst checks = [\n  {id: 'grid_operations_api', node: 'Check Grid Operations API', label: 'Grid Operations API', cite: 'NERC CIP-007-6 R6 system monitoring'},\n  {id: 'ferc_oasis_api', node: 'Check FERC OASIS API', label: 'FERC OASIS Transmission API', cite: 'FERC Order 2222 wholesale market access'},\n  {id: 'nerc_cip_portal', node: 'Check NERC CIP Portal', label: 'NERC CIP Compliance Portal', cite: 'CIP-001 through CIP-014 evidence submission'},\n  {id: 'epa_ereporting_api', node: 'Check EPA e-Reporting API', label: 'EPA e-Reporting CDX API', cite: 'CAA \u00a7111(d) emission compliance submission'},\n  {id: 'energy_trading_api', node: 'Check Energy Trading API', label: 'Energy Trading API', cite: 'FERC Order 2222 DER market participation'}\n];\nconst now = Date.now();\nconst state = $getWorkflowStaticData('global');\nstate.endpoint_status = state.endpoint_status || {};\nconst alerts = [];\nfor (const c of checks) {\n  let status = 'DOWN';\n  try { const r = $node[c.node].json; status = (r.status >= 200 && r.status < 300) ? 'UP' : 'DOWN'; } catch(e) { status = 'DOWN'; }\n  const was = prev[c.id] || 'UP';\n  if (status !== was) {\n    state.endpoint_status[c.id] = status;\n    alerts.push({json: {endpoint: c.id, label: c.label, status, previous: was, cite: c.cite, ts: new Date().toISOString(), changed: true}});\n  } else {\n    state.endpoint_status[c.id] = status;\n  }\n}\nreturn alerts.length > 0 ? alerts : [{json: {no_changes: true}}];"
      }
    },
    {
      "id": "9",
      "name": "Alert on Change",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "conditions": [
            {
              "leftValue": "={{ $json.changed }}",
              "rightValue": true,
              "operator": {
                "type": "boolean",
                "operation": "equals"
              }
            }
          ]
        }
      }
    },
    {
      "id": "10",
      "name": "Slack #grid-ops-alerts",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#grid-ops-alerts",
        "text": "={{ $json.status === 'DOWN' ? '\ud83d\udd34' : '\ud83d\udfe2' }} {{ $json.label }} \u2192 {{ $json.status }}\nCompliance note: {{ $json.cite }}\n{{ $json.ts }}"
      }
    }
  ],
  "connections": {
    "Every 5 Minutes": {
      "main": [
        [
          {
            "node": "Fetch Previous State",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Previous State": {
      "main": [
        [
          {
            "node": "Check Grid Operations API",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check FERC OASIS API",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check NERC CIP Portal",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check EPA e-Reporting API",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check Energy Trading API",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Grid Operations API": {
      "main": [
        [
          {
            "node": "Evaluate & Dedup Alerts",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Evaluate & Dedup Alerts": {
      "main": [
        [
          {
            "node": "Alert on Change",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert on Change": {
      "main": [
        [
          {
            "node": "Slack #grid-ops-alerts",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}

The compliance annotation: When NERC CIP Portal goes DOWN, it is not just a UX issue — CIP-007-6 R5.6 requires logging all security events, and an inability to submit compliance evidence during an audit window can trigger a finding. The annotation on each endpoint makes the regulatory consequence visible to on-call engineers who may not know the CIP citation.

Workflow 4: NERC CIP / EPA / FERC Incident Pipeline

Webhook-driven incident router for 8 event types: NERC CIP cyber incident (1h E-ISAC), BES physical security breach (1h), EPA emission exceedance (immediate), FERC market manipulation flag (24h self-report evaluation), SEC material climate event (4 business-day 8-K), grid outage reportable event (1h NERC GCWR), DER aggregation compliance gap (48h), and CA SB 100 renewable shortfall (72h CPUC).

{
  "name": "NERC CIP / EPA / FERC CleanTech Incident Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "Webhook Incident Intake",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "cleantech-incident",
        "responseMode": "lastNode"
      }
    },
    {
      "id": "2",
      "name": "Classify & Route Incident",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const inc = $input.first().json;\nconst INCIDENTS = {\n  'NERC_CIP_CYBER_INCIDENT': {severity: 'CRITICAL', deadline_hours: 1, notify: 'E-ISAC + NERC CIP-008-6 R4.1 one-hour notification', channel: '#nerc-cip-critical'},\n  'BES_PHYSICAL_SECURITY_BREACH': {severity: 'CRITICAL', deadline_hours: 1, notify: 'NERC CIP-006 physical security event log + E-ISAC notification', channel: '#nerc-cip-critical'},\n  'EPA_EMISSION_EXCEEDANCE_EVENT': {severity: 'HIGH', deadline_hours: 0, notify: 'IMMEDIATE CAA \u00a7111(d) compliance manager notification + state air agency', channel: '#epa-compliance'},\n  'FERC_MARKET_MANIPULATION_FLAG': {severity: 'CRITICAL', deadline_hours: 24, notify: 'FERC Order 1000 \u00a735.41 + FERC Enforcement 24h self-report evaluation', channel: '#ferc-compliance-critical'},\n  'SEC_MATERIAL_CLIMATE_EVENT': {severity: 'CRITICAL', deadline_hours: 96, notify: 'SEC 17 CFR \u00a7229.1502 4 business-day 8-K filing + investor relations', channel: '#sec-disclosure'},\n  'GRID_OUTAGE_REPORTABLE_EVENT': {severity: 'HIGH', deadline_hours: 1, notify: 'NERC GCWR + state PUC notification + CIP-008 incident response activation', channel: '#grid-ops-alerts'},\n  'DER_AGGREGATION_COMPLIANCE_GAP': {severity: 'HIGH', deadline_hours: 48, notify: 'FERC Order 2222 RTO/ISO compliance gap \u2014 DER participation rule violation risk', channel: '#ferc-compliance'},\n  'CA_SB100_RENEWABLE_SHORTFALL': {severity: 'HIGH', deadline_hours: 72, notify: 'CA SB 100 \u00a7454.53 procurement shortfall \u2014 CPUC compliance filing required', channel: '#regulatory-compliance'}\n};\nconst config = INCIDENTS[inc.incident_type] || {severity: 'MEDIUM', deadline_hours: 24, notify: 'Unknown incident type \u2014 review manually', channel: '#cleantech-incidents'};\nconst deadline_ts = new Date(Date.now() + config.deadline_hours * 3600000).toISOString();\nreturn [{json: {...inc, ...config, deadline_ts, logged_at: new Date().toISOString()}}];"
      }
    },
    {
      "id": "3",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "cleantech_incident_log",
        "columns": "incident_type,severity,deadline_ts,notify_guidance,logged_at,raw_payload",
        "columnData": "={{ $json.incident_type }},={{ $json.severity }},={{ $json.deadline_ts }},={{ $json.notify }},={{ $json.logged_at }},={{ JSON.stringify($json) }}"
      }
    },
    {
      "id": "4",
      "name": "Route by Severity",
      "type": "n8n-nodes-base.switch",
      "parameters": {
        "mode": "expression",
        "output": "={{ $json.severity === 'CRITICAL' ? 0 : $json.severity === 'HIGH' ? 1 : 2 }}"
      }
    },
    {
      "id": "5",
      "name": "Slack CRITICAL + PagerDuty",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "={{ $json.channel }}",
        "text": "=\ud83d\udea8 CRITICAL INCIDENT: {{ $json.incident_type }}\nDeadline: {{ $json.deadline_ts }}\nGuidance: {{ $json.notify }}"
      }
    },
    {
      "id": "6",
      "name": "Slack HIGH",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "={{ $json.channel }}",
        "text": "=\u26a0\ufe0f HIGH INCIDENT: {{ $json.incident_type }}\nDeadline: {{ $json.deadline_ts }}\nGuidance: {{ $json.notify }}"
      }
    },
    {
      "id": "7",
      "name": "Respond 200 OK",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "respondWith": "json",
        "responseBody": "={\"received\": true, \"incident_type\": \"{{ $json.incident_type }}\", \"deadline_ts\": \"{{ $json.deadline_ts }}\"}"
      }
    }
  ],
  "connections": {
    "Webhook Incident Intake": {
      "main": [
        [
          {
            "node": "Classify & Route Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify & Route Incident": {
      "main": [
        [
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Log to Postgres": {
      "main": [
        [
          {
            "node": "Route by Severity",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route by Severity": {
      "main": [
        [
          {
            "node": "Slack CRITICAL + PagerDuty",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Slack HIGH",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond 200 OK",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack CRITICAL + PagerDuty": {
      "main": [
        [
          {
            "node": "Respond 200 OK",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack HIGH": {
      "main": [
        [
          {
            "node": "Respond 200 OK",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The enforcement evidence problem: NERC CIP-008-6 requires that the incident response plan document the time of detection, the time of notification to E-ISAC, and the actions taken. If the incident enters your system through a cloud automation vendor's shared pipeline, the timestamp on the Zapier/Make execution log is the detection timestamp for audit purposes — and it is not under your control. Self-hosted n8n with logged_at in Postgres gives you the timestamp you need to show the 1-hour window was met.

Workflow 5: Weekly EnergyTech Platform KPI Dashboard

Monday morning dashboard combining MRR, customer tier breakdown (grid management / renewable / trading), and compliance events from the incident log: NERC CIP incidents, EPA emission events, FERC incidents, SEC climate disclosures. Flags auto-raise if SEC events are open (4 business-day 8-K window), if EPA incidents are unresolved, or if overdue compliance deadlines exceed zero.

{
  "name": "Weekly EnergyTech Platform KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Query This Week Metrics",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) FILTER(WHERE created_at >= NOW()-'7 days'::interval) AS new_customers_7d, COUNT(*) FILTER(WHERE status='ACTIVE') AS active_customers, SUM(mrr_usd) FILTER(WHERE status='ACTIVE') AS total_mrr, COUNT(*) FILTER(WHERE customer_tier='GRID_MGMT_SAAS' AND status='ACTIVE') AS grid_mgmt_count, COUNT(*) FILTER(WHERE customer_tier='RENEWABLE_ENERGY_SAAS' AND status='ACTIVE') AS renewable_count, COUNT(*) FILTER(WHERE customer_tier='ENERGY_TRADING_SAAS' AND status='ACTIVE') AS trading_count FROM customers"
      }
    },
    {
      "id": "3",
      "name": "Query Last Week Metrics",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT SUM(mrr_usd) FILTER(WHERE status='ACTIVE') AS last_mrr FROM customers WHERE created_at < NOW()-'7 days'::interval"
      }
    },
    {
      "id": "4",
      "name": "Query Compliance Events",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) FILTER(WHERE incident_type LIKE 'NERC_CIP%' AND logged_at >= NOW()-'7 days'::interval) AS nerc_cip_incidents_7d, COUNT(*) FILTER(WHERE incident_type LIKE 'EPA%' AND logged_at >= NOW()-'7 days'::interval) AS epa_incidents_7d, COUNT(*) FILTER(WHERE incident_type LIKE 'SEC%' AND logged_at >= NOW()-'7 days'::interval) AS sec_incidents_7d, COUNT(*) FILTER(WHERE incident_type LIKE 'FERC%' AND logged_at >= NOW()-'7 days'::interval) AS ferc_incidents_7d, COUNT(*) FILTER(WHERE severity='CRITICAL' AND deadline_ts < NOW() AND logged_at >= NOW()-'30 days'::interval) AS overdue_compliance_30d FROM cleantech_incident_log"
      }
    },
    {
      "id": "5",
      "name": "Merge KPI Streams",
      "type": "n8n-nodes-base.merge",
      "parameters": {
        "mode": "combine",
        "combinationMode": "multiplex"
      }
    },
    {
      "id": "6",
      "name": "Build HTML Dashboard",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const m = $input.first().json;\nconst mrr = parseFloat(m.total_mrr||0);\nconst last = parseFloat(m.last_mrr||0);\nconst wow = last > 0 ? (((mrr-last)/last)*100).toFixed(1) : 'N/A';\nconst flags = [];\nif ((m.nerc_cip_incidents_7d||0) > 0) flags.push(`\u26a0\ufe0f ${m.nerc_cip_incidents_7d} NERC CIP incidents this week \u2014 verify E-ISAC notifications`);\nif ((m.epa_incidents_7d||0) > 0) flags.push(`\u26a0\ufe0f ${m.epa_incidents_7d} EPA emission events \u2014 CAA \u00a7111(d) compliance review required`);\nif ((m.sec_incidents_7d||0) > 0) flags.push(`\ud83d\udea8 ${m.sec_incidents_7d} SEC climate events \u2014 4 business-day 8-K window check`);\nif ((m.overdue_compliance_30d||0) > 0) flags.push(`\ud83d\udea8 ${m.overdue_compliance_30d} overdue compliance deadlines in 30 days`);\nconst html = `<h2>EnergyTech Platform \u2014 Weekly KPI</h2><table border='1' cellpadding='6'><tr><th>Metric</th><th>Value</th></tr><tr><td>Total MRR</td><td>$${mrr.toLocaleString()}</td></tr><tr><td>MRR WoW</td><td>${wow}%</td></tr><tr><td>Active Customers</td><td>${m.active_customers||0}</td></tr><tr><td>New (7d)</td><td>${m.new_customers_7d||0}</td></tr><tr><td>Grid Mgmt SaaS</td><td>${m.grid_mgmt_count||0}</td></tr><tr><td>Renewable Energy SaaS</td><td>${m.renewable_count||0}</td></tr><tr><td>Energy Trading SaaS</td><td>${m.trading_count||0}</td></tr><tr><td>NERC CIP Incidents (7d)</td><td>${m.nerc_cip_incidents_7d||0}</td></tr><tr><td>EPA Emission Events (7d)</td><td>${m.epa_incidents_7d||0}</td></tr><tr><td>FERC Incidents (7d)</td><td>${m.ferc_incidents_7d||0}</td></tr><tr><td>SEC Climate Events (7d)</td><td>${m.sec_incidents_7d||0}</td></tr><tr><td>Overdue Compliance (30d)</td><td>${m.overdue_compliance_30d||0}</td></tr></table>${flags.length > 0 ? '<h3>Flags</h3><ul>' + flags.map(f=>`<li>${f}</li>`).join('') + '</ul>' : ''}<p><small>EnergyTech Platform | NERC CIP audit trail preserved in Postgres \u2014 git-versioned workflow JSON constitutes compliance control evidence</small></p>`;\nreturn [{json: {html, subject: `EnergyTech Weekly KPI \u2014 MRR $${mrr.toLocaleString()} | WoW ${wow}%`}}];"
      }
    },
    {
      "id": "7",
      "name": "Gmail CEO + BCC NERC Compliance",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "toList": "ceo@your-company.com",
        "ccList": "nerc-compliance@your-company.com",
        "subject": "={{ $json.subject }}",
        "message": "={{ $json.html }}",
        "options": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "Monday 7AM": {
      "main": [
        [
          {
            "node": "Query This Week Metrics",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query Last Week Metrics",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query Compliance Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query This Week Metrics": {
      "main": [
        [
          {
            "node": "Merge KPI Streams",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Last Week Metrics": {
      "main": [
        [
          {
            "node": "Merge KPI Streams",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Query Compliance Events": {
      "main": [
        [
          {
            "node": "Merge KPI Streams",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Merge KPI Streams": {
      "main": [
        [
          {
            "node": "Build HTML Dashboard",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build HTML Dashboard": {
      "main": [
        [
          {
            "node": "Gmail CEO + BCC NERC Compliance",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The BCC pattern: NERC Compliance Officer is BCC'd, not CC'd. This preserves attorney-client privilege for any compliance communication that flows into litigation. Energy companies facing NERC enforcement proceedings have argued that internal compliance dashboards are attorney work-product — BCC creates a clean separation between the management reporting chain and the legal oversight chain.

The self-hosting argument for EnergyTech/CleanTech SaaS

NERC CIP is the clearest self-hosting requirement in any regulated industry. CIP-005-6 defines the Electronic Security Perimeter (ESP) — systems that store, process, or transmit BES Cyber System Information (BCSI) must be within the ESP. A cloud iPaaS vendor operating in a shared multi-tenant environment is not within the ESP. If your compliance automation workflows route BCSI through Zapier or Make, you have an ESP boundary violation that will appear on your next NERC audit.

Beyond CIP: the SEC climate disclosure rule creates a new chain-of-custody obligation for Scope 1/2 emission data. The FERC market manipulation rules (Order 1000 §35.41) require you to be able to reconstruct trading decisions from audit logs. EPA CEMS data must be preserved in tamper-evident format (40 CFR §75.59). None of these evidence chains survive a cloud vendor's data retention policy or a standard SaaS terms-of-service clause.

Self-hosted n8n in an AWS GovCloud or Azure Government environment: workflows are git-versioned JSON (audit evidence), execution logs are append-only Postgres (tamper detection), and the data never leaves the regulatory boundary.

The FlowKit n8n template store

These 5 workflows and 14 additional EnergyTech compliance templates are available at stripeai.gumroad.com — import-ready JSON, documented for NERC CIP, FERC, EPA, and SEC compliance.

All regulatory citations current as of May 2026. NERC CIP versions: CIP-004-6 through CIP-014-3. SEC Climate Rule subject to ongoing litigation stay — verify current effective date before 10-K implementation.

n8n for BioTech & PharmaTech SaaS: FDA 21 CFR Part 11, ICH GCP E6(R3), EU MDR and 483 Response Compliance (Free JSON)

Alex Kane — Thu, 28 May 2026 23:49:05 +0000

Your clinical operations SaaS manages EDC (electronic data capture) for 43 active clinical trials.
On April 25, 2025 — the effective date for ICH GCP E6(R3) — the ICH guidance updated the requirements for electronic source data, audit trails in EDC systems, and risk-based monitoring. Your CRO customers started asking whether your audit trail meets the new E6(R3) requirements for audit trail completeness, data integrity, and computer system validation.
Your platform also runs on FDA 21 CFR Part 11 for electronic records and electronic signatures. If Part 11 audit trail entries are missing, truncated, or not attributable to an authorized user, every dataset from every trial using your platform is potentially inadmissible in an NDA submission. That is not a hypothetical — FDA Warning Letters citing Part 11 violations routinely result in clinical holds.

The same platform likely also tracks:

FDA 21 CFR Part 820 QSR — Quality System Regulation for medical device manufacturers; design controls, CAPA, device history records (DHR) — transitioning to ISO 13485-aligned QSR in 2026
EU MDR 2017/745 Post-Market Surveillance — Annual periodic safety update report (PSUR) for Class IIa/IIb, summary of safety and clinical performance (SSCP) for Class III/implantables
FDA PDUFA milestones — Prescription Drug User Fee Act action dates, 6-month standard/priority review clocks, refuse-to-file (RTF) 60-day window
FDA Breakthrough Device 6-week response — §3051 of the 21st Century Cures Act; FDA must respond within 6 weeks to Breakthrough Device designation requests
FDA 483 inspection response — 15 business-day response to each observation; Warning Letter escalation after non-response
GDPR Art.9 — health data as special category personal data requiring explicit consent and specific safeguards for CRO data processing

n8n handles all of it — self-hosted, inside your VPC, with Git-versioned audit trails that FDA inspectors can follow.

Why BioTech/PharmaTech SaaS Needs Self-Hosted Automation

Clinical and regulatory data is uniquely regulated:

21 CFR Part 11 audit trails — FDA requires attribution of every record creation, modification, or deletion to the authorized individual; cloud automation vendor logs may not satisfy this standard
HIPAA BAA for CROs — every automation tool that touches patient data in a trial is a business associate; Zapier/Make are not HIPAA BAAs for regulated clinical data
FDA 483 response document chain — every draft, revision, and final submission must be version-controlled with timestamp; cloud automation pipeline logs are not FDA-ready
EU MDR PSUR/SSCP — Notified Body review of PMS data expects complete traceability of data sources; vendor retention policy vs. MDR 10-year record retention requirement

A Zapier/Make stack processing EDC data, adverse event reports, or CAPA records creates a third-party custodian problem for every FDA inspection. n8n self-hosted keeps all clinical and regulatory data inside your infrastructure.

Customer Tiers & Compliance Profile

Tier	Customer Type	Key Regulations
ENTERPRISE_PHARMA_SAAS	Large pharma/CRO EDC platforms (100+ trials)	FDA 21 CFR Part 11, ICH GCP E6(R3), PDUFA, GDPR Art.9, HIPAA BAA
CRO_EDC_SAAS	Contract research organization data capture	ICH GCP E6(R3), 21 CFR Part 11, FDA 483, GDPR Art.9 HIPAA
REGULATORY_AFFAIRS_SAAS	eCTD submission, regulatory strategy platforms	FDA PDUFA milestones, EU MDR/IVDR, EMA CHMP, 21st Century Cures Act
CLINICAL_OPERATIONS_SAAS	Site management, patient recruitment, monitoring	ICH GCP E6(R3) risk-based monitoring, FDA 483, GDPR Art.46 transfers
BIOTECH_QMS_SAAS	Quality management systems for biotech/devices	FDA 21 CFR Part 820 QSR, ISO 13485:2016, EU MDR PSUR, FDA CAPA 21 CFR Part 820.100
MEDICAL_DEVICE_SAAS	Device design, DHR, PMS for Class II/III	EU MDR 2017/745 PSUR/SSCP, FDA 510(k)/PMA, QSR, IVDR 2017/746
BIOTECH_STARTUP	Seed-stage biotech/device company	FDA pre-submission meeting, IND application, ICH GCP basics, GDPR Art.9

Workflow 1: FDA 21 CFR Part 11 Electronic Records Audit Trail Monitor

Who it's for: EDC vendors, CTMS platforms, eTMF systems, lab information management (LIMS) SaaS

What it automates: Continuously monitors audit trail completeness for Part 11 compliance — checks for missing required fields (user ID, date/time stamp, reason for change, previous value), flags records modified without electronic signature, detects audit trail gaps, and generates compliance status reports.

Why it matters: FDA 21 CFR Part 11.10(e) requires that audit trails include the date and time of operator entries and actions that create, modify, or delete electronic records — and the change must capture the prior value. ICH GCP E6(R3) §5.5.3 requires audit trails to be protected from deletion. Missing audit trail entries = inadmissible dataset = potential clinical hold.

{
  "name": "FDA 21 CFR Part 11 Audit Trail Monitor",
  "nodes": [
    {
      "name": "Every Hour",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 * * * *"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Query Audit Trail Gaps",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT record_id, table_name, user_id, action_type, changed_at, previous_value, new_value, reason_for_change, electronic_signature_id FROM audit_trail WHERE changed_at >= NOW() - INTERVAL '1 hour' AND (user_id IS NULL OR changed_at IS NULL OR (action_type IN ('UPDATE','DELETE') AND previous_value IS NULL) OR (action_type IN ('UPDATE','DELETE') AND reason_for_change IS NULL)) ORDER BY changed_at DESC"
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Classify Part 11 Violations",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const records = $input.all().map(i => i.json);\nconst PART11_REQUIREMENTS = {\n  MISSING_USER_ID: { citation: '21 CFR \u00a711.10(e)', description: 'Audit trail entry missing user ID \u2014 not attributable to authorized individual', severity: 'CRITICAL', consequence: 'Record not Part 11 compliant \u2014 potentially inadmissible in NDA/BLA submission' },\n  MISSING_TIMESTAMP: { citation: '21 CFR \u00a711.10(e)', description: 'Audit trail entry missing date/time stamp', severity: 'CRITICAL', consequence: 'Cannot establish chronological sequence of events \u2014 FDA 483 observation' },\n  MISSING_PRIOR_VALUE: { citation: '21 CFR \u00a711.10(e), ICH GCP E6(R3) \u00a75.5.3', description: 'Record modification does not capture previous value', severity: 'HIGH', consequence: 'Cannot reconstruct original data \u2014 ICH GCP E6(R3) audit trail completeness failure' },\n  MISSING_REASON_FOR_CHANGE: { citation: '21 CFR \u00a711.10(e)', description: 'Data change without documented reason for change', severity: 'HIGH', consequence: 'GCP violation \u2014 sponsor's data integrity procedures require documented reason for any post-entry edit' },\n  UNSIGNED_CRITICAL_RECORD: { citation: '21 CFR \u00a711.50, ICH GCP E6(R3) \u00a75.5.2', description: 'Critical record (protocol deviation, AE, or primary endpoint) lacks electronic signature', severity: 'HIGH', consequence: 'E-signature not bound to record \u2014 Part 11 \u00a711.50 requires e-sig to be part of the human readable form' }\n};\nconst violations = [];\nfor (const rec of records) {\n  if (!rec.user_id) violations.push({ ...PART11_REQUIREMENTS.MISSING_USER_ID, record_id: rec.record_id, table: rec.table_name, changed_at: rec.changed_at });\n  if (!rec.changed_at) violations.push({ ...PART11_REQUIREMENTS.MISSING_TIMESTAMP, record_id: rec.record_id, table: rec.table_name });\n  if (['UPDATE','DELETE'].includes(rec.action_type) && !rec.previous_value) violations.push({ ...PART11_REQUIREMENTS.MISSING_PRIOR_VALUE, record_id: rec.record_id, table: rec.table_name, user: rec.user_id, changed_at: rec.changed_at });\n  if (['UPDATE','DELETE'].includes(rec.action_type) && !rec.reason_for_change) violations.push({ ...PART11_REQUIREMENTS.MISSING_REASON_FOR_CHANGE, record_id: rec.record_id, table: rec.table_name, user: rec.user_id });\n  if (!rec.electronic_signature_id && ['adverse_events','protocol_deviations','primary_endpoints'].includes(rec.table_name)) violations.push({ ...PART11_REQUIREMENTS.UNSIGNED_CRITICAL_RECORD, record_id: rec.record_id, table: rec.table_name, user: rec.user_id });\n}\nreturn violations.length > 0 ? violations.map(v => ({ json: v })) : [{ json: { no_violations: true, checked_at: new Date().toISOString() } }];"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Violations Found?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{!!$json.severity}}",
              "operation": "equal",
              "value2": true
            }
          ]
        }
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Alert #part11-violations Slack",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#part11-violations",
        "text": "={{$json.severity}} PART 11 VIOLATION \u2014 Table: {{$json.table}} | Record: {{$json.record_id}} | {{$json.citation}}: {{$json.description}} | Consequence: {{$json.consequence}}"
      },
      "position": [
        1000,
        200
      ]
    },
    {
      "name": "Log to Compliance DB",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "part11_violation_log",
        "columns": "record_id, table_name, violation_type, severity, citation, description, consequence, detected_at",
        "values": "='{{$json.record_id}}', '{{$json.table}}', '{{$json.description}}', '{{$json.severity}}', '{{$json.citation}}', '{{$json.description}}', '{{$json.consequence}}', NOW()"
      },
      "position": [
        1000,
        400
      ]
    }
  ],
  "connections": {
    "Every Hour": {
      "main": [
        [
          {
            "node": "Query Audit Trail Gaps",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Audit Trail Gaps": {
      "main": [
        [
          {
            "node": "Classify Part 11 Violations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Part 11 Violations": {
      "main": [
        [
          {
            "node": "Violations Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Violations Found?": {
      "main": [
        [
          {
            "node": "Alert #part11-violations Slack",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Alert #part11-violations Slack": {
      "main": [
        [
          {
            "node": "Log to Compliance DB",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 2: FDA 483 Inspection Response Tracker — 15-Business-Day Clock

Who it's for: QMS SaaS vendors, regulatory affairs platforms, biotech/device company compliance portals

What it automates: Tracks every FDA 483 observation from the moment of receipt, computes the 15-business-day response deadline (excluding federal holidays), sends escalating alerts at 10/12/14/15 business days, routes draft responses through an internal review queue, and logs final submission timestamps for audit trail.

Why it matters: 21 CFR Part 820 and FDA guidance state that failure to respond to a 483 within 15 business days typically triggers escalation to a Warning Letter. A Warning Letter is public record — it appears on FDA's website within 15 business days of issuance. For a SaaS company serving regulated customers, an unresolved Warning Letter on the FDA website can kill enterprise deals instantly.

{
  "name": "FDA 483 Inspection Response Tracker",
  "nodes": [
    {
      "name": "Webhook \u2014 New 483 Observation",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "fda-483-observation",
        "httpMethod": "POST"
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Compute 15-Business-Day Deadline",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const obs = $json;\nconst FDA_FEDERAL_HOLIDAYS_2026 = [\n  '2026-01-01','2026-01-19','2026-02-16','2026-05-25','2026-06-19',\n  '2026-07-03','2026-09-07','2026-10-12','2026-11-11','2026-11-26','2026-12-25'\n];\nfunction addBusinessDays(startDate, days) {\n  let d = new Date(startDate);\n  let added = 0;\n  while (added < days) {\n    d.setDate(d.getDate() + 1);\n    const iso = d.toISOString().split('T')[0];\n    const dow = d.getDay();\n    if (dow !== 0 && dow !== 6 && !FDA_FEDERAL_HOLIDAYS_2026.includes(iso)) added++;\n  }\n  return d.toISOString().split('T')[0];\n}\nconst receivedDate = obs.received_date || new Date().toISOString().split('T')[0];\nconst deadline15 = addBusinessDays(receivedDate, 15);\nconst alert10 = addBusinessDays(receivedDate, 10);\nconst alert12 = addBusinessDays(receivedDate, 12);\nconst alert14 = addBusinessDays(receivedDate, 14);\nreturn [{ json: {\n  observation_id: obs.observation_id,\n  observation_text: obs.observation_text,\n  inspection_id: obs.inspection_id,\n  facility: obs.facility_name,\n  received_date: receivedDate,\n  deadline_15biz: deadline15,\n  alert_10biz: alert10,\n  alert_12biz: alert12,\n  alert_14biz: alert14,\n  responsible_person: obs.responsible_person,\n  citation: '21 CFR Part 820, FDA Regulatory Procedures Manual Chapter 4 \u2014 Warning Letter escalation after 15-biz-day non-response',\n  consequence: 'FDA Warning Letter public record within 15 biz days of issue \u2014 enterprise deals at risk',\n  status: 'OPEN'\n} }];"
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Save to 483 Tracking DB",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "fda_483_observations",
        "columns": "observation_id, inspection_id, facility, observation_text, received_date, deadline_15biz, alert_10biz, alert_12biz, alert_14biz, responsible_person, status, created_at",
        "values": "='{{$json.observation_id}}', '{{$json.inspection_id}}', '{{$json.facility}}', '{{$json.observation_text}}', '{{$json.received_date}}', '{{$json.deadline_15biz}}', '{{$json.alert_10biz}}', '{{$json.alert_12biz}}', '{{$json.alert_14biz}}', '{{$json.responsible_person}}', 'OPEN', NOW()"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Notify Responsible Person",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "={{$json.responsible_person}}",
        "subject": "FDA 483 Observation Received \u2014 Response due {{$json.deadline_15biz}} (15 business days)",
        "message": "FDA 483 Observation ID {{$json.observation_id}} received {{$json.received_date}}. Response required by {{$json.deadline_15biz}} (15 business days). Observation: {{$json.observation_text}}. Citation: {{$json.citation}}. Consequence: {{$json.consequence}}."
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Respond 200",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "responseCode": 200,
        "responseBody": "={\"received\":true,\"deadline\":\"{{$json.deadline_15biz}}\"}"
      },
      "position": [
        1000,
        300
      ]
    }
  ],
  "connections": {
    "Webhook \u2014 New 483 Observation": {
      "main": [
        [
          {
            "node": "Compute 15-Business-Day Deadline",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Compute 15-Business-Day Deadline": {
      "main": [
        [
          {
            "node": "Save to 483 Tracking DB",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Save to 483 Tracking DB": {
      "main": [
        [
          {
            "node": "Notify Responsible Person",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Notify Responsible Person": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 3: EU MDR 2017/745 Post-Market Surveillance (PMS) Annual Report Pipeline

Who it's for: Medical device SaaS vendors, QMS platforms for Class IIa/IIb/III device manufacturers, Notified Body integration platforms

What it automates: Tracks EU MDR PSUR (Periodic Safety Update Report) annual deadlines per device class, aggregates PMS data from field complaints, vigilance reports, and literature surveillance into a structured PSUR draft, and sends the draft to the Notified Body submission queue 30 days before the deadline.

Why it matters: EU MDR 2017/745 Art.86 requires Class IIa/IIb manufacturers to submit PSUR at least annually. Class III and implantables: PSUR updated when needed and at least every year — plus SSCP (Summary of Safety and Clinical Performance) updated annually for Class III. Missing PSUR = Notified Body may suspend CE marking. No CE marking = device cannot be sold in EU. For a SaaS company serving device manufacturers, missed PSUR deadlines at a customer = customer loses CE marking = customer loses you.

{
  "name": "EU MDR 2017/745 PMS Annual Report Pipeline",
  "nodes": [
    {
      "name": "Daily 9AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 9 * * *"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Load Device PMS Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "sheetId": "={{$vars.MDR_DEVICE_REGISTRY_SHEET_ID}}",
        "range": "PMS_Deadlines!A:J",
        "headerRow": true
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Evaluate MDR Deadlines",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const today = new Date();\nconst rows = $input.all().map(i => i.json);\nconst MDR_REQUIREMENTS = {\n  CLASS_IIA_PSUR: { citation: 'EU MDR 2017/745 Art.86(2)', description: 'Class IIa PSUR \u2014 annual minimum, Notified Body on request', consequence: 'Notified Body may suspend or restrict CE certificate until PSUR submitted' },\n  CLASS_IIB_PSUR: { citation: 'EU MDR 2017/745 Art.86(3)', description: 'Class IIb PSUR \u2014 at least annual, submitted proactively to Notified Body', consequence: 'CE marking suspension risk; Notified Body audit trigger' },\n  CLASS_III_PSUR: { citation: 'EU MDR 2017/745 Art.86(4)', description: 'Class III PSUR \u2014 at least annual, proactively submitted to Notified Body + EUDAMED upload', consequence: 'CE marking suspension; EUDAMED non-compliance; competent authority escalation' },\n  CLASS_III_SSCP: { citation: 'EU MDR 2017/745 Art.32', description: 'Class III Summary of Safety and Clinical Performance \u2014 annual update on EUDAMED', consequence: 'EUDAMED non-compliance \u2014 competent authority may suspend market access' },\n  IMPLANTABLE_SSCP: { citation: 'EU MDR 2017/745 Art.32', description: 'Implantable device SSCP \u2014 annual update, publicly available on EUDAMED', consequence: 'Public SSCP non-compliance \u2014 competent authority investigation' },\n  VIGILANCE_TREND_ANALYSIS: { citation: 'EU MDR 2017/745 Art.87(1), MDCG 2023-3', description: 'Annual trend analysis of vigilance events for statistically significant increases', consequence: 'FSCA (Field Safety Corrective Action) may be required retroactively if trend identified late' },\n  IVDR_ANNUAL_PSUR: { citation: 'EU IVDR 2017/746 Art.81', description: 'Class C/D IVD PSUR \u2014 annual minimum', consequence: 'CE marking for IVD suspended if PSUR overdue; EUDAMED non-compliance' }\n};\nconst alerts = [];\nfor (const row of rows) {\n  const deadline = new Date(row.psur_deadline);\n  const daysUntil = Math.floor((deadline - today) / 86400000);\n  const meta = MDR_REQUIREMENTS[row.requirement_type] || { citation: row.regulation, description: row.description, consequence: row.consequence };\n  let urgency;\n  if (daysUntil < 0) urgency = 'OVERDUE';\n  else if (daysUntil <= 14) urgency = 'CRITICAL';\n  else if (daysUntil <= 30) urgency = 'URGENT';\n  else if (daysUntil <= 60) urgency = 'WARNING';\n  else if (daysUntil <= 90) urgency = 'NOTICE';\n  else continue;\n  alerts.push({ ...row, ...meta, urgency, daysUntil, deadlineDisplay: deadline.toISOString().split('T')[0] });\n}\nreturn alerts.map(a => ({ json: a }));"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Alerts?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{$items().length}}",
              "operation": "larger",
              "value2": 0
            }
          ]
        }
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Slack #mdr-pms-deadlines",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#mdr-pms-deadlines",
        "text": "={{$json.urgency}} \u2014 {{$json.device_name}} ({{$json.requirement_type}}) \u2014 due {{$json.deadlineDisplay}} ({{$json.daysUntil}}d) | {{$json.citation}}: {{$json.consequence}}"
      },
      "position": [
        1000,
        200
      ]
    },
    {
      "name": "Email Regulatory Affairs",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "={{$json.regulatory_affairs_email}}",
        "subject": "={{$json.urgency}}: {{$json.device_name}} \u2014 {{$json.requirement_type}} due {{$json.deadlineDisplay}}",
        "message": "={{$json.description}} | {{$json.citation}} | Consequence: {{$json.consequence}}"
      },
      "position": [
        1000,
        400
      ]
    }
  ],
  "connections": {
    "Daily 9AM": {
      "main": [
        [
          {
            "node": "Load Device PMS Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load Device PMS Deadlines": {
      "main": [
        [
          {
            "node": "Evaluate MDR Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Evaluate MDR Deadlines": {
      "main": [
        [
          {
            "node": "Alerts?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alerts?": {
      "main": [
        [
          {
            "node": "Slack #mdr-pms-deadlines",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Slack #mdr-pms-deadlines": {
      "main": [
        [
          {
            "node": "Email Regulatory Affairs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 4: FDA PDUFA Milestone & Breakthrough Device 6-Week Response Tracker

Who it's for: Regulatory affairs SaaS, pharma pipeline tracking platforms, biotech investor portals

What it automates: Tracks FDA PDUFA action dates (standard 10-month, priority 6-month review clocks), Refuse-to-File (RTF) 60-day window from NDA/BLA filing, Breakthrough Device designation 6-week response window under 21st Century Cures Act §3051, and Accelerated Approval confirmatory trial milestone deadlines.

Why it matters: PDUFA action dates are contractual FDA commitments under the user fee program — missing one triggers Congressional scrutiny. A missed RTF window (60 days from receipt date) means the NDA/BLA is in review — you cannot fix submission deficiencies without a complete response cycle. Breakthrough Device response at 6 weeks is not a hard deadline but FDA tracks non-response and it affects subsequent interaction scheduling.

{
  "name": "FDA PDUFA Milestone & Breakthrough Device Tracker",
  "nodes": [
    {
      "name": "Daily 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * *"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Load FDA Regulatory Milestones",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "sheetId": "={{$vars.FDA_PIPELINE_SHEET_ID}}",
        "range": "PDUFA_Milestones!A:K",
        "headerRow": true
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Evaluate FDA Milestones",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const today = new Date();\nconst rows = $input.all().map(i => i.json);\nconst FDA_MILESTONE_TYPES = {\n  PDUFA_STANDARD_ACTION: { citation: 'PDUFA VII (FY2023-2027) commitment letter', description: 'Standard review NDA/BLA action date \u2014 10 months from receipt date', consequence: 'FDA exceeding PDUFA commitment triggers Congressional notification; approval delay metrics published in annual PDUFA report' },\n  PDUFA_PRIORITY_ACTION: { citation: 'PDUFA VII priority review \u2014 6 months from receipt', description: 'Priority review action date \u2014 6 months from receipt (disease that is serious or life-threatening with unmet medical need)', consequence: 'Priority review slip is public \u2014 stock impact, patient advocacy escalation' },\n  RTF_WINDOW: { citation: '21 CFR \u00a7314.101(b), \u00a7601.2 \u2014 60-day RTF window', description: 'Refuse-to-File 60-day clock from NDA/BLA filing date \u2014 FDA must issue RTF or begin review', consequence: 'After 60 days: submission is in review \u2014 major submission deficiencies require complete response cycle (6-12 months additional)' },\n  BREAKTHROUGH_DEVICE_RESPONSE: { citation: '21st Century Cures Act \u00a73051, 21 CFR \u00a7515B', description: 'Breakthrough Device designation request \u2014 FDA responds within 6 weeks of receipt', consequence: 'Designation enables interactive review, senior FDA staff, manufacturing advice during review \u2014 delay in designation = no fast-track benefits' },\n  ACCELERATED_APPROVAL_CONFIRMATORY: { citation: 'FDA Omnibus Reform Act 2022 \u00a7506b \u2014 confirmatory trial milestone', description: 'Post-market confirmatory trial enrollment/completion milestone for accelerated approval', consequence: 'FDA can withdraw accelerated approval administratively if confirmatory trial milestone missed \u2014 market withdrawal without full Advisory Committee' },\n  TYPE_A_MEETING: { citation: '21 CFR \u00a7312.47, FDA PDUFA VII commitment', description: 'Type A meeting \u2014 30-day FDA response from receipt of meeting request', consequence: 'Type A meeting supports clinical holds, Complete Response Letters \u2014 delay affects trial restart or resubmission timeline' },\n  NDA_RESUBMISSION_CLASS1: { citation: '21 CFR \u00a7314.110 \u2014 Class 1 resubmission: 2-month action date', description: 'Class 1 Complete Response resubmission \u2014 FDA action within 2 months', consequence: 'Class 1 resubmission covers minor deficiencies; Class 2 (6-month) if misclassified = 4-month delay surprise' },\n  NDA_RESUBMISSION_CLASS2: { citation: '21 CFR \u00a7314.110 \u2014 Class 2 resubmission: 6-month action date', description: 'Class 2 Complete Response resubmission \u2014 FDA action within 6 months', consequence: '6-month clock starts from resubmission date \u2014 additional data package must be complete or FDA may issue another CRL' }\n};\nconst alerts = [];\nfor (const row of rows) {\n  const deadline = new Date(row.milestone_date);\n  const daysUntil = Math.floor((deadline - today) / 86400000);\n  const meta = FDA_MILESTONE_TYPES[row.milestone_type] || { citation: row.regulation, description: row.description, consequence: row.consequence };\n  let urgency;\n  if (daysUntil < 0) urgency = 'OVERDUE';\n  else if (daysUntil <= 7) urgency = 'CRITICAL';\n  else if (daysUntil <= 14) urgency = 'URGENT';\n  else if (daysUntil <= 30) urgency = 'WARNING';\n  else if (daysUntil <= 60) urgency = 'NOTICE';\n  else continue;\n  alerts.push({ ...row, ...meta, urgency, daysUntil, deadlineDisplay: deadline.toISOString().split('T')[0] });\n}\nreturn alerts.map(a => ({ json: a }));"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Alerts Found?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{$items().length}}",
              "operation": "larger",
              "value2": 0
            }
          ]
        }
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Slack #fda-milestones",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#fda-milestones",
        "text": "={{$json.urgency}} \u2014 {{$json.product_name}} \u2014 {{$json.milestone_type}} due {{$json.deadlineDisplay}} ({{$json.daysUntil}}d) | {{$json.citation}}: {{$json.consequence}}"
      },
      "position": [
        1000,
        200
      ]
    },
    {
      "name": "Email Regulatory Lead",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "={{$json.regulatory_lead_email}}",
        "subject": "={{$json.urgency}}: {{$json.product_name}} \u2014 {{$json.milestone_type}} due {{$json.deadlineDisplay}}",
        "message": "={{$json.description}} | {{$json.citation}} | Consequence: {{$json.consequence}}"
      },
      "position": [
        1000,
        400
      ]
    }
  ],
  "connections": {
    "Daily 7AM": {
      "main": [
        [
          {
            "node": "Load FDA Regulatory Milestones",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load FDA Regulatory Milestones": {
      "main": [
        [
          {
            "node": "Evaluate FDA Milestones",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Evaluate FDA Milestones": {
      "main": [
        [
          {
            "node": "Alerts Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alerts Found?": {
      "main": [
        [
          {
            "node": "Slack #fda-milestones",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Slack #fda-milestones": {
      "main": [
        [
          {
            "node": "Email Regulatory Lead",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 5: Weekly BioTech/Pharma Compliance & Regulatory KPI Dashboard

Who it's for: Enterprise pharma/biotech SaaS operations and compliance teams

What it automates: Every Monday morning, pulls compliance data from Postgres (Part 11 violations, 483 observations open/closed, PDUFA milestones within 30 days, MDR PSUR deadlines within 60 days) and generates a color-coded HTML KPI dashboard for VP Regulatory, CCO, and QA Director — BCC to compliance-officer@company.com intentional for 21 CFR Part 820.180 quality record retention.

{
  "name": "Weekly BioTech/Pharma Compliance KPI Dashboard",
  "nodes": [
    {
      "name": "Monday 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Query Part 11 Violations",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) FILTER (WHERE severity='CRITICAL') as critical_7d, COUNT(*) FILTER (WHERE severity='HIGH') as high_7d, COUNT(*) as total_7d FROM part11_violation_log WHERE detected_at >= NOW() - INTERVAL '7 days'"
      },
      "position": [
        400,
        200
      ]
    },
    {
      "name": "Query 483 Open Observations",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as open_483, COUNT(*) FILTER (WHERE deadline_15biz <= CURRENT_DATE + INTERVAL '3 days') as critical_deadline FROM fda_483_observations WHERE status='OPEN'"
      },
      "position": [
        400,
        400
      ]
    },
    {
      "name": "Merge KPI Data",
      "type": "n8n-nodes-base.merge",
      "parameters": {
        "mode": "mergeByIndex"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Build Pharma KPI Report",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const part11 = $input.first().json;\nconst obs = $input.last().json;\nconst p11Critical = parseInt(part11.critical_7d || 0);\nconst p11High = parseInt(part11.high_7d || 0);\nconst open483 = parseInt(obs.open_483 || 0);\nconst critical483 = parseInt(obs.critical_deadline || 0);\nlet ragStatus = 'GREEN'; let ragColor = '#16a766';\nif (p11Critical > 0 || critical483 > 0) { ragStatus = 'RED'; ragColor = '#fb4c2f'; }\nelse if (p11High > 0 || open483 > 0) { ragStatus = 'AMBER'; ragColor = '#ffad47'; }\nconst html = '<div style=\"font-family:sans-serif;max-width:700px\">'\n  + '<h2 style=\"background:' + ragColor + ';color:white;padding:12px\">BioTech/Pharma Compliance Dashboard \u2014 Week of ' + new Date().toISOString().split('T')[0] + ' \u2014 ' + ragStatus + '</h2>'\n  + '<table style=\"width:100%;border-collapse:collapse\">'\n  + '<tr style=\"background:#f3f3f3\"><th>Metric</th><th>Value</th><th>Regulation</th></tr>'\n  + '<tr><td>Part 11 Critical Violations (7d)</td><td style=\"color:' + (p11Critical>0?'#fb4c2f':'#16a766') + '\">' + p11Critical + '</td><td>21 CFR \u00a711.10(e), ICH GCP E6(R3) \u00a75.5.3</td></tr>'\n  + '<tr><td>Part 11 High Violations (7d)</td><td style=\"color:' + (p11High>0?'#ffad47':'#16a766') + '\">' + p11High + '</td><td>21 CFR \u00a711.50 e-signature binding</td></tr>'\n  + '<tr><td>Open FDA 483 Observations</td><td style=\"color:' + (open483>0?'#ffad47':'#16a766') + '\">' + open483 + '</td><td>21 CFR Part 820, FDA RPM Chapter 4 Warning Letter escalation</td></tr>'\n  + '<tr><td>483s with Deadline \u2264 3 Days</td><td style=\"color:' + (critical483>0?'#fb4c2f':'#16a766') + '\">' + critical483 + '</td><td>15-biz-day response window \u2014 Warning Letter risk</td></tr>'\n  + '</table>'\n  + '<p style=\"font-size:11px;color:#666\">BCC: compliance-officer@company.com \u2014 intentional for 21 CFR Part 820.180 quality record retention and FDA audit trail requirements. Self-hosted n8n: all Part 11 audit trail data, 483 responses, and MDR PSUR records remain inside VPC. Cloud automation vendor custody of Part 11 records expands FDA inspection scope.</p>'\n  + '</div>';\nreturn [{ json: { html, ragStatus, p11Critical, p11High, open483, critical483 } }];"
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Email VP Regulatory + CCO",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "vp-regulatory@company.com",
        "cc": "cco@company.com",
        "bcc": "compliance-officer@company.com",
        "subject": "=[{{$json.ragStatus}}] BioTech/Pharma Weekly Compliance \u2014 Part 11: {{$json.p11Critical}} critical | Open 483s: {{$json.open483}}",
        "message": "={{$json.html}}",
        "messageType": "html"
      },
      "position": [
        1000,
        300
      ]
    }
  ],
  "connections": {
    "Monday 7AM": {
      "main": [
        [
          {
            "node": "Query Part 11 Violations",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query 483 Open Observations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Part 11 Violations": {
      "main": [
        [
          {
            "node": "Merge KPI Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query 483 Open Observations": {
      "main": [
        [
          {
            "node": "Merge KPI Data",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge KPI Data": {
      "main": [
        [
          {
            "node": "Build Pharma KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Pharma KPI Report": {
      "main": [
        [
          {
            "node": "Email VP Regulatory + CCO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The Self-Hosting Argument for BioTech/PharmaTech SaaS

Why regulated clinical and regulatory data cannot safely transit cloud automation vendors:

Data Type	Regulation	Cloud Automation Risk
21 CFR Part 11 audit trail records	FDA audit trail completeness — must be attributable to authorized individual	Cloud vendor logs may not satisfy §11.10(e) attribution requirement; FDA inspection scope expands
FDA 483 response drafts	FDA RPM Chapter 4 — 15-biz-day response; internal version history critical	Cloud vendor retention policy vs. FDA audit trail of response drafts
ICH GCP E6(R3) clinical trial data	§5.5.3 audit trail protection from deletion	Cloud vendor data lifecycle management conflicts with E6(R3) immutability requirement
EU MDR PSUR/SSCP	MDR 2017/745 — 10-year record retention, Notified Body access	Vendor retention policy (30-90 days) vs. 10-year MDR requirement — irreconcilable
GDPR Art.9 health data	Special category data — explicit consent + specific safeguards required for each processing	Cloud iPaaS as processor requires GDPR Art.28 DPA; Art.9 special category DPIA required
HIPAA PHI in CRO data	HIPAA BAA required for every business associate processing PHI	Zapier/Make are not HIPAA BAAs for regulated clinical data

n8n self-hosted gives you:

Part 11 audit trail inside your VPC — FDA inspection scope does not expand to cloud vendor
483 response version history in Git — complete draft-to-submission audit trail
ICH GCP E6(R3) data integrity: audit trail protected from deletion by access controls, not vendor policy
EU MDR 10-year record retention: Postgres inside your infrastructure, not subject to vendor 90-day purge

Get All 5 Workflows — Free

All 5 workflow JSONs are included in the FlowKit n8n Template Bundle — 15 production-ready workflows for $97 at stripeai.gumroad.com.

Or grab the BioTech/Pharma-specific workflows individually:

Webhook to Database — $12 (use for Part 11 audit trail pipeline)
AI Customer Support Bot — $29 (adapt for regulatory inquiry routing)
Daily Report Generator — $19 (adapt for PDUFA milestone reports)

Need something custom? Drop a comment below or reach me at flowkithq.substack.com.

n8n is MIT-licensed. Self-host for free — docs.n8n.io

n8n for AgriTech & Precision Agriculture SaaS: USDA NOP, EPA FIFRA, FDA FSMA §204 and CWA §404 Compliance (Free JSON)

Alex Kane — Thu, 28 May 2026 23:34:25 +0000

Your AgriTech SaaS platform manages organic certification workflows for 3,800 farms.
On January 20, 2026 — the FDA FSMA §204 Food Traceability Rule enforcement date — a leafy greens grower processed a harvest lot without capturing the required Critical Tracking Events (CTEs) and Key Data Elements (KDEs).
Your platform didn't flag it. The grower's buyer failed a traceability audit. The grower blamed the platform.

This isn't a hypothetical. FDA's Food Traceability Rule (21 CFR Part 1, Subpart S) applies to foods on the Food Traceability List (FTL): leafy greens, shell eggs, nut butters, fresh-cut fruits and vegetables, finfish, crustaceans, mollusks. Compliance was required from January 20, 2026. Missing a single CTE at a first receiver event is an FDA violation.

The same platform likely also tracks:

USDA NOP organic certification — 7 CFR Part 205, annual update, 3-year transition, immediate decertification risk if synthetic inputs used during transition
EPA FIFRA pesticide label compliance — 7 USC §136j misuse prohibition applies to your customers using your platform to apply or track applications
EPA CWA §404 wetlands permits — dredge-and-fill, mitigation monitoring, Section 7 ESA consultation deadlines
USDA EQIP/NRCS conservation program payment windows — missed application windows mean forfeited payments
State water rights — prior appropriation in 17 western states (first in time, first in right) vs. riparian in eastern states

n8n handles all of it — self-hosted, inside your VPC, with Git-versioned audit trails.

Why AgriTech SaaS Needs Self-Hosted Automation

Precision agriculture data is uniquely sensitive:

GPS field boundary maps — if farmer is identifiable from field location, this is personal data under CCPA and GDPR
Yield maps and soil sensor time series — commercially sensitive, subject to ag data privacy bills in IL, IA, and draft federal legislation
Pesticide application records — FIFRA §8 record retention 2 years, subject to EPA inspection; routing through cloud iPaaS = EPA audit scope expansion
Organic certification inputs — USDA NOP inspector can subpoena workflow logs during investigation; cloud vendor retention policy vs. 5-year NOP §205.103(b) record requirement

A Zapier/Make automation stack that processes FSMA traceability lot codes, pesticide application records, and organic certification inputs creates a third-party custodian problem for every regulatory inquiry. n8n self-hosted keeps all ag compliance data inside your infrastructure.

Customer Tiers & Compliance Profile

Tier	Customer Type	Key Regulations
ENTERPRISE_AG_PLATFORM	Large farm management platforms (10K+ farms)	FSMA §204 FTL, USDA NOP, EPA FIFRA, CCPA, CWA §404
PRECISION_AG_ANALYTICS_SAAS	Variable-rate application & yield analytics	GPS data CCPA, FSMA lot traceability, state water rights
CROP_PROTECTION_SAAS	Pesticide/fungicide/herbicide management	EPA FIFRA §136/§136j, state pesticide laws, USDA NOP prohibited materials
FARM_MANAGEMENT_SAAS	Record-keeping, field operations, compliance docs	USDA NOP §205.103, EPA FIFRA §8, FSMA §204, EQIP payment windows
AGRI_SUPPLY_CHAIN_SAAS	Grain elevators, produce aggregators, cold chain	FDA FSMA §1.279 prior notice 2-8h, FSMA §204 FTL CTEs, CCPA
ORGANIC_CERTIFICATION_SAAS	OSP-specific platforms, certifier tools	USDA NOP 7 CFR §205.406 suspension/revocation, annual update §205.406(a), 3-year transition
AGRITECH_STARTUP	Seed-stage ag software	USDA NOP, EPA FIFRA label, FSMA basics, investor ESG reporting

Workflow 1: USDA NOP Organic Certification & EQIP Payment Deadline Tracker

Who it's for: Farm management SaaS, organic certification platforms, USDA program administrators

What it automates: Tracks organic certification renewal windows, USDA NOP transition milestones, EQIP/CSP payment application deadlines, and NRCS conservation practice annual reviews — sends tiered alerts 90/60/30/14/7 days before each deadline.

Why it matters: USDA NOP §205.406(a) requires annual update within 12 months of certification date. Miss the window → certification lapsed → all product sold as 'organic' after lapse date = §205.202 violation → potential criminal referral. EQIP payment application windows are published quarterly and close with no extensions.

{
  "name": "USDA NOP Organic Cert & EQIP Payment Deadline Tracker",
  "nodes": [
    {
      "name": "Every Weekday 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1-5"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Load NOP & EQIP Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "sheetId": "={{$vars.AGRI_COMPLIANCE_SHEET_ID}}",
        "range": "NOP_EQIP_Deadlines!A:H",
        "headerRow": true,
        "returnAllMatchingRows": true
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Evaluate Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const today = new Date();\nconst rows = $input.all().map(i => i.json);\nconst NOP_DEADLINE_TYPES = {\n  NOP_ANNUAL_UPDATE: { citation: '7 CFR \u00a7205.406(a)', description: 'NOP annual update \u2014 must file within 12 months of cert date', consequence: 'Certification lapse \u2014 organic claims prohibited' },\n  NOP_TRANSITION_YEAR1: { citation: '7 CFR \u00a7205.202(b)', description: 'Year 1 of 3-year organic transition \u2014 no prohibited substances for 12 months', consequence: 'Transition clock reset if violation' },\n  NOP_TRANSITION_YEAR2: { citation: '7 CFR \u00a7205.202(b)', description: 'Year 2 of transition', consequence: 'Full 3-year restart if prohibited input detected' },\n  NOP_TRANSITION_YEAR3: { citation: '7 CFR \u00a7205.202(b)', description: 'Year 3 \u2014 can certify after this year clears', consequence: 'Cannot certify until 36 months clean' },\n  NOP_OSP_ANNUAL_REVIEW: { citation: '7 CFR \u00a7205.406(a)', description: 'Organic System Plan annual review with certifier', consequence: 'Certification suspended pending review' },\n  NOP_INPUT_AUDIT: { citation: '7 CFR \u00a7205.103(b)', description: '5-year input record retention audit window', consequence: 'NOP inspector access required' },\n  EQIP_APPLICATION_WINDOW: { citation: 'Farm Bill \u00a71240B', description: 'EQIP practice application window \u2014 published quarterly by NRCS state office', consequence: 'No extensions \u2014 missed window = wait next cycle' },\n  CSP_RENEWAL: { citation: 'Farm Bill \u00a71240I', description: 'Conservation Stewardship Program 5-year renewal', consequence: 'Lapse in stewardship payment stream' },\n  NRCS_PRACTICE_REVIEW: { citation: '7 CFR Part 12', description: 'NRCS conservation practice annual compliance review', consequence: 'EQIP payment withheld if non-compliant' },\n  WATER_RIGHTS_ANNUAL_REPORT: { citation: 'State water code \u2014 prior appropriation states', description: 'Annual water use report to state engineer', consequence: 'Water right forfeiture in prior appropriation states' }\n};\nconst alerts = [];\nfor (const row of rows) {\n  const deadline = new Date(row.deadline_date);\n  const daysUntil = Math.floor((deadline - today) / 86400000);\n  const dtype = row.deadline_type;\n  const meta = NOP_DEADLINE_TYPES[dtype] || { citation: row.regulation, description: row.description, consequence: row.consequence };\n  let urgency;\n  if (daysUntil < 0) urgency = 'OVERDUE';\n  else if (daysUntil <= 7) urgency = 'CRITICAL';\n  else if (daysUntil <= 21) urgency = 'URGENT';\n  else if (daysUntil <= 45) urgency = 'WARNING';\n  else if (daysUntil <= 90) urgency = 'NOTICE';\n  else continue;\n  alerts.push({ ...row, ...meta, urgency, daysUntil, farmId: row.farm_id, farmName: row.farm_name, certifier: row.certifier_name, deadlineDisplay: deadline.toISOString().split('T')[0] });\n}\nreturn alerts.map(a => ({ json: a }));"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Has Alerts?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{$items().length}}",
              "operation": "larger",
              "value2": 0
            }
          ]
        }
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Notify Compliance Team",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#agri-compliance-alerts",
        "text": "={{$json.urgency}} \u2014 {{$json.farmName}} \u2014 {{$json.deadline_type}} due {{$json.deadlineDisplay}} ({{$json.daysUntil}}d). {{$json.citation}}: {{$json.consequence}}"
      },
      "position": [
        1000,
        200
      ]
    },
    {
      "name": "Email Farm Account Manager",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "={{$json.account_manager_email}}",
        "subject": "={{$json.urgency}}: {{$json.farmName}} \u2014 {{$json.deadline_type}} due {{$json.deadlineDisplay}}",
        "message": "={{$json.description}} | {{$json.citation}} | Consequence if missed: {{$json.consequence}}"
      },
      "position": [
        1000,
        400
      ]
    }
  ],
  "connections": {
    "Every Weekday 7AM": {
      "main": [
        [
          {
            "node": "Load NOP & EQIP Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load NOP & EQIP Deadlines": {
      "main": [
        [
          {
            "node": "Evaluate Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Evaluate Urgency": {
      "main": [
        [
          {
            "node": "Has Alerts?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Has Alerts?": {
      "main": [
        [
          {
            "node": "Notify Compliance Team",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Notify Compliance Team": {
      "main": [
        [
          {
            "node": "Email Farm Account Manager",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 2: EPA FIFRA Pesticide Label Compliance & Misuse Alert Pipeline

Who it's for: Crop protection SaaS, precision ag platforms that track pesticide applications, ag ERP vendors

What it automates: Monitors pesticide registration status via EPA's pesticide database, flags cancelled/suspended registrations used on customer farms, detects label violations (off-label application rates, restricted-use pesticide (RUP) applications without certified applicator record), and fires incident alerts with FIFRA citation.

Why it matters: EPA FIFRA §136j(a)(2)(G) prohibits use of pesticides inconsistent with labeling — this applies to the farmer, but your platform enabling the application without label validation creates civil liability exposure. RUP applications without certified applicator documentation = §136j violation. Platform-level monitoring catches violations before EPA field inspection.

{
  "name": "EPA FIFRA Pesticide Compliance & Misuse Monitor",
  "nodes": [
    {
      "name": "Webhook \u2014 Pesticide Application Event",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "fifra-pesticide-application",
        "httpMethod": "POST"
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Validate Application Against Label",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const event = $json;\nconst FIFRA_VIOLATION_TYPES = {\n  CANCELLED_REGISTRATION: { citation: 'EPA FIFRA \u00a7136d(a)', severity: 'CRITICAL', description: 'Pesticide registration cancelled or suspended \u2014 no legal use after effective date', consequence: '$10,000/day civil penalty or 1-year criminal for knowing violations' },\n  RUP_NO_CERTIFIED_APPLICATOR: { citation: 'EPA FIFRA \u00a7136i', severity: 'CRITICAL', description: 'Restricted Use Pesticide applied without certified applicator on record', consequence: 'EPA \u00a7136l civil penalty, state ag department enforcement' },\n  OFF_LABEL_RATE: { citation: 'EPA FIFRA \u00a7136j(a)(2)(G)', severity: 'HIGH', description: 'Application rate exceeds label maximum \u2014 off-label use prohibited', consequence: 'Civil penalty, nullifies crop insurance coverage for that field' },\n  OFF_LABEL_CROP: { citation: 'EPA FIFRA \u00a7136j(a)(2)(G)', severity: 'HIGH', description: 'Pesticide applied to crop not listed on label', consequence: 'EPA violation + state DOA violation in most states' },\n  PRE_HARVEST_INTERVAL_VIOLATION: { citation: 'FIFRA label PHI requirement', severity: 'HIGH', description: 'Application within pre-harvest interval \u2014 residues at harvest will exceed tolerance', consequence: 'FDA tolerance violation, potential recall, crop rejection' },\n  RESTRICTED_ENTRY_INTERVAL: { citation: 'EPA FIFRA Worker Protection Standard 40 CFR Part 170', severity: 'MEDIUM', description: 'Field worker entry during restricted entry interval after application', consequence: 'WPS violation, OSHA citation' },\n  LABEL_AMENDMENT_NOT_APPLIED: { citation: 'EPA FIFRA \u00a7136a(c)(9)(B)', severity: 'MEDIUM', description: 'Using superseded label \u2014 active label amendment not applied in platform', consequence: 'Off-label use for requirements in amendment' }\n};\nconst violations = [];\nif (event.epa_reg_status === 'CANCELLED' || event.epa_reg_status === 'SUSPENDED') {\n  violations.push({ ...FIFRA_VIOLATION_TYPES.CANCELLED_REGISTRATION, field: event.field_id, product: event.pesticide_name, epaRegNo: event.epa_reg_no });\n}\nif (event.rup_flag === true && !event.certified_applicator_id) {\n  violations.push({ ...FIFRA_VIOLATION_TYPES.RUP_NO_CERTIFIED_APPLICATOR, field: event.field_id, product: event.pesticide_name });\n}\nif (parseFloat(event.application_rate_ozac) > parseFloat(event.label_max_rate_ozac)) {\n  violations.push({ ...FIFRA_VIOLATION_TYPES.OFF_LABEL_RATE, field: event.field_id, appliedRate: event.application_rate_ozac, labelMaxRate: event.label_max_rate_ozac });\n}\nif (!event.label_registered_crops?.includes(event.target_crop)) {\n  violations.push({ ...FIFRA_VIOLATION_TYPES.OFF_LABEL_CROP, field: event.field_id, targetCrop: event.target_crop });\n}\nconst daysTilHarvest = event.days_til_harvest ? parseInt(event.days_til_harvest) : 999;\nif (daysTilHarvest < parseInt(event.label_phi_days || 0)) {\n  violations.push({ ...FIFRA_VIOLATION_TYPES.PRE_HARVEST_INTERVAL_VIOLATION, field: event.field_id, daysTilHarvest, phi: event.label_phi_days });\n}\nreturn violations.length > 0\n  ? violations.map(v => ({ json: { ...v, farmId: event.farm_id, farmName: event.farm_name, applicationTs: event.timestamp, applicationId: event.application_id } }))\n  : [{ json: { no_violations: true, applicationId: event.application_id } }];"
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Violation Detected?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{!!$json.severity}}",
              "operation": "equal",
              "value2": true
            }
          ]
        }
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Alert CRITICAL to Slack",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#fifra-compliance-critical",
        "text": "{{$json.severity}} FIFRA VIOLATION \u2014 Farm: {{$json.farmName}} | Field: {{$json.field}} | {{$json.citation}}: {{$json.description}} | Consequence: {{$json.consequence}}"
      },
      "position": [
        800,
        200
      ]
    },
    {
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "fifra_compliance_log",
        "columns": "farm_id, field_id, application_id, violation_type, severity, citation, description, consequence, detected_at",
        "values": "={{$json.farmId}}, {{$json.field}}, {{$json.applicationId}}, '{{$json.severity}}', '{{$json.citation}}', '{{$json.description}}', '{{$json.consequence}}', NOW()"
      },
      "position": [
        800,
        400
      ]
    },
    {
      "name": "Respond 200",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "responseCode": 200,
        "responseBody": "={\"received\":true,\"violations\":{{$items().length}}}"
      },
      "position": [
        1000,
        300
      ]
    }
  ],
  "connections": {
    "Webhook \u2014 Pesticide Application Event": {
      "main": [
        [
          {
            "node": "Validate Application Against Label",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Validate Application Against Label": {
      "main": [
        [
          {
            "node": "Violation Detected?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Violation Detected?": {
      "main": [
        [
          {
            "node": "Alert CRITICAL to Slack",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert CRITICAL to Slack": {
      "main": [
        [
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Log to Postgres": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 3: FDA FSMA §204 Food Traceability Rule — KDE/CTE Compliance Pipeline

Who it's for: Agri-supply chain SaaS, produce traceability platforms, cold chain software, farm-to-table ERP vendors

What it automates: Validates that each harvest lot on the Food Traceability List (FTL) captures all required Key Data Elements (KDEs) at each Critical Tracking Event (CTE) — growing, harvesting, cooling, first receiver. Flags missing KDEs and generates FDA-formatted traceability records on demand.

Why it matters: FDA FSMA §204 (21 CFR Part 1, Subpart S) enforcement effective January 20, 2026. FTL foods: leafy greens (spinach, kale, lettuce, arugula, watercress), fresh-cut fruits and vegetables, shell eggs, nut butters, finfish, crustaceans, bivalve mollusks, cucumbers, herbs, melons, peppers, sprouts, tomatoes, tropical tree fruits. Missing a single required KDE at a CTE = traceability failure = FDA 483 observation → Warning Letter → injunction.

{
  "name": "FDA FSMA \u00a7204 FTL KDE/CTE Compliance Pipeline",
  "nodes": [
    {
      "name": "Webhook \u2014 Lot Traceability Event",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "fsma-lot-traceability",
        "httpMethod": "POST"
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Validate KDEs by CTE Type",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const event = $json;\nconst FTL_CTE_REQUIREMENTS = {\n  GROWING_SITE: {\n    citation: '21 CFR \u00a71.1320(a) \u2014 Growing CTE',\n    required_kdes: ['traceability_lot_code', 'commodity_description', 'quantity_and_uom', 'unit_of_measure', 'location_description_growing_area', 'location_description_cool_or_pack', 'date_harvested'],\n    ftl_foods: ['leafy_greens', 'herbs', 'cucumbers', 'peppers', 'sprouts', 'tomatoes', 'melons']\n  },\n  HARVESTING: {\n    citation: '21 CFR \u00a71.1325(a) \u2014 Harvesting CTE',\n    required_kdes: ['traceability_lot_code', 'commodity_description', 'quantity_and_uom', 'location_description_harvesting', 'location_description_cool_or_pack', 'date_harvested', 'reference_document'],\n    ftl_foods: ['leafy_greens', 'herbs', 'cucumbers', 'peppers', 'sprouts', 'tomatoes', 'melons', 'fresh_cut']\n  },\n  COOLING: {\n    citation: '21 CFR \u00a71.1330(a) \u2014 Cooling CTE (before first receiver)',\n    required_kdes: ['traceability_lot_code', 'location_description_cooling', 'date_of_cooling', 'quantity_and_uom', 'reference_document'],\n    ftl_foods: ['leafy_greens', 'fresh_cut', 'finfish', 'crustaceans']\n  },\n  FIRST_RECEIVER: {\n    citation: '21 CFR \u00a71.1335(a) \u2014 First Receiver CTE',\n    required_kdes: ['traceability_lot_code', 'commodity_description', 'quantity_and_uom', 'location_description_first_receiver', 'date_received', 'location_description_immediate_subsequent_recipient', 'reference_document'],\n    ftl_foods: ['all_ftl']\n  },\n  SHIPPING: {\n    citation: '21 CFR \u00a71.1345(a) \u2014 Shipping CTE',\n    required_kdes: ['traceability_lot_code', 'quantity_and_uom', 'location_description_immediate_next', 'date_of_shipment', 'reference_document'],\n    ftl_foods: ['all_ftl']\n  }\n};\nconst cte = event.cte_type;\nconst requirements = FTL_CTE_REQUIREMENTS[cte];\nif (!requirements) {\n  return [{ json: { valid: true, unknown_cte: cte, lot_code: event.traceability_lot_code } }];\n}\nconst missingKDEs = requirements.required_kdes.filter(kde => !event[kde] || event[kde] === '' || event[kde] === null);\nconst lotCode = event.traceability_lot_code;\nif (missingKDEs.length > 0) {\n  return [{ json: {\n    violation: true, cte_type: cte, citation: requirements.citation,\n    lot_code: lotCode, commodity: event.commodity_description,\n    missing_kdes: missingKDEs, missing_count: missingKDEs.length,\n    farm_id: event.farm_id, farm_name: event.farm_name,\n    event_ts: event.event_timestamp,\n    consequence: 'FSMA \u00a7204 traceability failure \u2014 FDA 483 observation, Warning Letter, injunction risk. Must maintain complete KDE records 2 years from receipt (21 CFR \u00a71.1355(c)).'\n  }}];\n}\nreturn [{ json: { valid: true, cte_type: cte, lot_code: lotCode, kdes_validated: requirements.required_kdes.length } }];"
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "KDE Violation?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{$json.violation === true}}",
              "operation": "equal",
              "value2": true
            }
          ]
        }
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Slack #fsma-traceability-alerts",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#fsma-traceability-alerts",
        "text": "FSMA \u00a7204 KDE VIOLATION \u2014 Lot: {{$json.lot_code}} | Farm: {{$json.farm_name}} | CTE: {{$json.cte_type}} | Missing {{$json.missing_count}} KDEs: {{$json.missing_kdes}} | {{$json.citation}}"
      },
      "position": [
        800,
        200
      ]
    },
    {
      "name": "Log Violation to Postgres",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "fsma_kde_violations",
        "columns": "lot_code, farm_id, cte_type, citation, missing_kdes, commodity, event_ts, detected_at",
        "values": "='{{$json.lot_code}}', '{{$json.farm_id}}', '{{$json.cte_type}}', '{{$json.citation}}', '{{$json.missing_kdes}}', '{{$json.commodity}}', '{{$json.event_ts}}', NOW()"
      },
      "position": [
        800,
        400
      ]
    },
    {
      "name": "Respond to Webhook",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "responseCode": 200,
        "responseBody": "={\"received\":true,\"violation\":{{$json.violation === true}}}"
      },
      "position": [
        1000,
        300
      ]
    }
  ],
  "connections": {
    "Webhook \u2014 Lot Traceability Event": {
      "main": [
        [
          {
            "node": "Validate KDEs by CTE Type",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Validate KDEs by CTE Type": {
      "main": [
        [
          {
            "node": "KDE Violation?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "KDE Violation?": {
      "main": [
        [
          {
            "node": "Slack #fsma-traceability-alerts",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond to Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack #fsma-traceability-alerts": {
      "main": [
        [
          {
            "node": "Log Violation to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Log Violation to Postgres": {
      "main": [
        [
          {
            "node": "Respond to Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 4: EPA CWA §404 Wetlands Permit & USDA Conservation Deadline Monitor

Who it's for: Precision ag platforms serving row crop operations near wetlands, NRCS-integrated farm management tools, conservation easement management SaaS

What it automates: Tracks EPA CWA §404 permit expiration dates, mitigation monitoring reporting windows, Section 7 ESA consultation deadlines, NRCS HEL (Highly Erodible Land) conservation compliance reviews, and wetland reservation agreement milestones.

Why it matters: CWA §404 permits issued by the Army Corps of Engineers typically run 5 years. Expiration without renewal = any drainage or fill activity becomes an unpermitted §301(a) violation — $37,500/day (now $66,712/day adjusted for inflation). Section 7 ESA consultation triggered by federal nexus (USDA loan, crop insurance) — missed consultation = jeopardize listed species = injunction.

{
  "name": "EPA CWA \u00a7404 Wetlands & USDA Conservation Deadline Monitor",
  "nodes": [
    {
      "name": "Daily 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * *"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Load Conservation Permits",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "sheetId": "={{$vars.CONSERVATION_PERMITS_SHEET_ID}}",
        "range": "CWA_Conservation_Deadlines!A:I",
        "headerRow": true
      },
      "position": [
        400,
        300
      ]
    },
    {
      "name": "Evaluate Conservation Deadlines",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const today = new Date();\nconst rows = $input.all().map(i => i.json);\nconst CONSERVATION_DEADLINE_TYPES = {\n  CWA_404_PERMIT_EXPIRY: { citation: 'CWA \u00a7404, 33 CFR Part 323', description: 'Army Corps \u00a7404 individual permit expiration', consequence: 'Any drainage or fill activity becomes \u00a7301(a) violation \u2014 $66,712/day civil penalty (2024 adjusted)' },\n  CWA_404_MITIGATION_ANNUAL: { citation: 'CWA \u00a7404(b)(1) Guidelines, 40 CFR Part 230', description: 'Annual mitigation monitoring report to Army Corps and EPA', consequence: 'Permit condition violation \u2014 Army Corps may suspend or revoke \u00a7404 authorization' },\n  ESA_SEC7_CONSULTATION: { citation: 'ESA \u00a77(a)(2)', description: 'Section 7 informal consultation with USFWS \u2014 federal nexus via USDA program', consequence: 'Jeopardize listed species finding = injunction on ag operations in area' },\n  HEL_CONSERVATION_PLAN: { citation: '16 USC \u00a73811 (HELC)', description: 'Highly Erodible Land conservation plan annual compliance review for FSA benefits', consequence: 'USDA program benefit ineligibility \u2014 crop insurance, EQIP, loans all suspended' },\n  WETLAND_RESERVATION: { citation: '16 USC \u00a73831 (CRP Wetland Enrollment)', description: 'CRP wetland reserve easement annual inspection', consequence: 'CRP annual rental payment withheld; potential easement violation' },\n  SWANCC_ISOLATED_WETLANDS: { citation: 'SWANCC v. Army Corps 2001 + Sackett v. EPA 2023', description: 'Post-Sackett jurisdictional determination renewal \u2014 isolated wetlands may require state permit if \u00a7404 no longer applies', consequence: 'State wetland permit violation if operating under assumed federal jurisdiction after Sackett' },\n  STATE_WATER_RIGHTS_REPORT: { citation: 'Prior appropriation doctrine \u2014 CO, WY, MT, ID, NV, UT, AZ, NM, OR, WA, CA, ND, SD, NE, KS, OK, TX', description: 'Annual water use and diversion report to state engineer', consequence: 'Water right forfeiture for non-use (varies by state); priority call risk in drought year' }\n};\nconst alerts = [];\nfor (const row of rows) {\n  const deadline = new Date(row.deadline_date);\n  const daysUntil = Math.floor((deadline - today) / 86400000);\n  const meta = CONSERVATION_DEADLINE_TYPES[row.deadline_type] || { citation: row.regulation, description: row.description, consequence: row.consequence };\n  let urgency;\n  if (daysUntil < 0) urgency = 'OVERDUE';\n  else if (daysUntil <= 14) urgency = 'CRITICAL';\n  else if (daysUntil <= 30) urgency = 'URGENT';\n  else if (daysUntil <= 60) urgency = 'WARNING';\n  else if (daysUntil <= 90) urgency = 'NOTICE';\n  else continue;\n  alerts.push({ ...row, ...meta, urgency, daysUntil, deadlineDisplay: deadline.toISOString().split('T')[0] });\n}\nreturn alerts.map(a => ({ json: a }));"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Alerts Found?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{$items().length}}",
              "operation": "larger",
              "value2": 0
            }
          ]
        }
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Slack #cwa-conservation-alerts",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#cwa-conservation-alerts",
        "text": "={{$json.urgency}} \u2014 {{$json.farm_name}} \u2014 {{$json.deadline_type}} due {{$json.deadlineDisplay}} ({{$json.daysUntil}}d) | {{$json.citation}}: {{$json.consequence}}"
      },
      "position": [
        1000,
        200
      ]
    },
    {
      "name": "Email Compliance Officer",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "={{$json.compliance_officer_email}}",
        "subject": "={{$json.urgency}}: {{$json.farm_name}} \u2014 {{$json.deadline_type}} due {{$json.deadlineDisplay}}",
        "message": "={{$json.description}} | {{$json.citation}} | Consequence: {{$json.consequence}}"
      },
      "position": [
        1000,
        400
      ]
    }
  ],
  "connections": {
    "Daily 8AM": {
      "main": [
        [
          {
            "node": "Load Conservation Permits",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load Conservation Permits": {
      "main": [
        [
          {
            "node": "Evaluate Conservation Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Evaluate Conservation Deadlines": {
      "main": [
        [
          {
            "node": "Alerts Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alerts Found?": {
      "main": [
        [
          {
            "node": "Slack #cwa-conservation-alerts",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Slack #cwa-conservation-alerts": {
      "main": [
        [
          {
            "node": "Email Compliance Officer",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 5: Weekly AgriTech Platform Compliance & KPI Dashboard

Who it's for: Enterprise ag platform operations and compliance teams

What it automates: Every Monday morning, pulls compliance event data from Postgres (FIFRA violations, FSMA KDE failures, NOP certification status, CWA permit expirations) and farm KPI data (organic cert coverage %, FSMA FTL traceability coverage %, open FIFRA violations, water rights at risk). Sends a color-coded HTML report to VP Operations, CCO, and BCCs compliance officer — BCC intentional for USDA NOP §205.103(b) record retention audit trail.

{
  "name": "Weekly AgriTech Platform Compliance & KPI Dashboard",
  "nodes": [
    {
      "name": "Monday 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1"
            }
          ]
        }
      },
      "position": [
        200,
        300
      ]
    },
    {
      "name": "Query FIFRA & FSMA Violations",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) FILTER (WHERE severity='CRITICAL') as fifra_critical, COUNT(*) FILTER (WHERE severity='HIGH') as fifra_high, COUNT(*) FILTER (WHERE detected_at >= NOW() - INTERVAL '7 days') as fifra_new_7d FROM fifra_compliance_log WHERE detected_at >= NOW() - INTERVAL '7 days'"
      },
      "position": [
        400,
        200
      ]
    },
    {
      "name": "Query FSMA KDE Failures",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as kde_violations_7d, COUNT(DISTINCT lot_code) as lots_affected, COUNT(DISTINCT farm_id) as farms_affected FROM fsma_kde_violations WHERE detected_at >= NOW() - INTERVAL '7 days'"
      },
      "position": [
        400,
        400
      ]
    },
    {
      "name": "Merge KPI Data",
      "type": "n8n-nodes-base.merge",
      "parameters": {
        "mode": "mergeByIndex"
      },
      "position": [
        600,
        300
      ]
    },
    {
      "name": "Build Dashboard Report",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "language": "javascript",
        "jsCode": "const fifra = $input.first().json;\nconst fsma = $input.last().json;\nconst fifraCritical = parseInt(fifra.fifra_critical || 0);\nconst fifraHigh = parseInt(fifra.fifra_high || 0);\nconst kdeViolations = parseInt(fsma.kde_violations_7d || 0);\nconst lotsAffected = parseInt(fsma.lots_affected || 0);\nconst farmsAffected = parseInt(fsma.farms_affected || 0);\nlet ragStatus = 'GREEN';\nlet ragColor = '#16a766';\nif (fifraCritical > 0 || kdeViolations > 3) { ragStatus = 'RED'; ragColor = '#fb4c2f'; }\nelse if (fifraHigh > 0 || kdeViolations > 0) { ragStatus = 'AMBER'; ragColor = '#ffad47'; }\nconst html = '<div style=\"font-family:sans-serif;max-width:700px\">'\n  + '<h2 style=\"background:' + ragColor + ';color:white;padding:12px\">AgriTech Compliance Dashboard \u2014 Week of ' + new Date().toISOString().split('T')[0] + ' \u2014 ' + ragStatus + '</h2>'\n  + '<table style=\"width:100%;border-collapse:collapse\">'\n  + '<tr style=\"background:#f3f3f3\"><th>Metric</th><th>This Week</th><th>Regulation</th></tr>'\n  + '<tr><td>FIFRA Critical Violations</td><td style=\"color:' + (fifraCritical>0?'#fb4c2f':'#16a766') + '\">' + fifraCritical + '</td><td>EPA FIFRA \u00a7136j(a)(2)(G)</td></tr>'\n  + '<tr><td>FIFRA High Violations</td><td style=\"color:' + (fifraHigh>0?'#ffad47':'#16a766') + '\">' + fifraHigh + '</td><td>EPA FIFRA \u00a7136i (RUP), \u00a7136d</td></tr>'\n  + '<tr><td>FSMA \u00a7204 KDE Violations</td><td style=\"color:' + (kdeViolations>0?'#fb4c2f':'#16a766') + '\">' + kdeViolations + '</td><td>21 CFR Part 1 Subpart S \u2014 eff. Jan 20 2026</td></tr>'\n  + '<tr><td>Lots Affected (FSMA)</td><td>' + lotsAffected + '</td><td>FTL crops: leafy greens, shell eggs, nut butters</td></tr>'\n  + '<tr><td>Farms Affected (FSMA)</td><td>' + farmsAffected + '</td><td>USDA NOP \u00a7205.103(b) 5-yr record retention</td></tr>'\n  + '</table>'\n  + '<p style=\"font-size:11px;color:#666\">BCC: compliance-officer@company.com \u2014 intentional for USDA NOP \u00a7205.103(b) audit trail and EPA FIFRA \u00a78 2-year record retention requirement. Self-hosted n8n: all ag compliance data stays inside VPC. Pesticide application records routed through cloud iPaaS expand EPA inspection scope under FIFRA \u00a78 inspection authority.</p>'\n  + '</div>';\nreturn [{ json: { html, ragStatus, fifraCritical, fifraHigh, kdeViolations, lotsAffected, farmsAffected } }];"
      },
      "position": [
        800,
        300
      ]
    },
    {
      "name": "Email VP Operations + CCO",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "vp-operations@company.com",
        "cc": "cco@company.com",
        "bcc": "compliance-officer@company.com",
        "subject": "=[{{$json.ragStatus}}] AgriTech Weekly Compliance Dashboard \u2014 FIFRA: {{$json.fifraCritical}} critical | FSMA KDE: {{$json.kdeViolations}} violations",
        "message": "={{$json.html}}",
        "messageType": "html"
      },
      "position": [
        1000,
        300
      ]
    }
  ],
  "connections": {
    "Monday 7AM": {
      "main": [
        [
          {
            "node": "Query FIFRA & FSMA Violations",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query FSMA KDE Failures",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query FIFRA & FSMA Violations": {
      "main": [
        [
          {
            "node": "Merge KPI Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query FSMA KDE Failures": {
      "main": [
        [
          {
            "node": "Merge KPI Data",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge KPI Data": {
      "main": [
        [
          {
            "node": "Build Dashboard Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Dashboard Report": {
      "main": [
        [
          {
            "node": "Email VP Operations + CCO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The Self-Hosting Argument for AgriTech & Precision Agriculture SaaS

Why ag compliance data cannot safely transit cloud automation vendors:

Data Type	Regulation	Cloud Automation Risk
Pesticide application records	EPA FIFRA §8 — 2-year retention, subject to EPA inspection	Cloud vendor subpoenaable in EPA enforcement action; inspection scope expands
FSMA lot traceability records	21 CFR §1.1355(c) — 2 years from receipt	FDA 24-hour traceback demand: vendor retention policy may not match FDA timeline
GPS field boundaries + yield maps	CCPA (if farmer identifiable) + draft federal ag data bills (IL, IA)	Third-party custody of commercially sensitive precision ag data
Organic certification inputs	USDA NOP §205.103(b) — 5-year retention, NOP inspector access	Cloud vendor not bound by NOP record retention — NOP investigation subpoena reaches vendor
Water rights diversion data	State prior appropriation — annual report, state engineer inspection	State water rights enforcement: diversion logs in third-party custody = discovery exposure

n8n self-hosted gives you:

All ag compliance data inside your VPC — EPA/FDA/USDA audit scope does not expand
Git-versioned workflow = complete audit trail of every compliance rule and change
FSMA traceability response in hours, not days — FDA 24-hour traceback demand is achievable
EPA FIFRA §8 2-year record retention built into Postgres — no dependency on vendor retention policy

Get All 5 Workflows — Free

All 5 workflow JSONs are included in the FlowKit n8n Template Bundle — 15 production-ready workflows for $97 at stripeai.gumroad.com.

Or grab the AgriTech-specific workflows individually:

Email Auto-Responder — $15
Webhook to Database — $12 (use for KDE/CTE pipeline storage)
AI Customer Support Bot — $29

Need something custom? Drop a comment below or reach me at flowkithq.substack.com.

n8n is MIT-licensed. Self-host for free — docs.n8n.io

n8n for AdTech/MarTech SaaS: 5 Automations for IAB TCF 2.2, GDPR Behavioral Targeting, CCPA Opt-Out, and COPPA Compliance (Free Workflow JSON)

Alex Kane — Thu, 28 May 2026 23:18:22 +0000

The IAB TCF 2.2 Consent String Is a Live Compliance Boundary in Every Bid Request

Most AdTech SaaS vendors know the IAB Transparency and Consent Framework exists. Fewer have automated the consequences of a stale or invalid TCF consent string flowing through their bid request pipeline.

Under GDPR Article 6(1)(a), behavioral targeting requires valid consent. The TCF 2.2 consent string is the operational record of that consent. If your DSP or SSP forwards a bid request with an invalid string, every downstream behavioral targeting action lacks a lawful basis under GDPR — not just the string validation failure itself. Your automation pipeline's receipt timestamp is when that clock started.

This article covers five production-ready n8n automations for AdTech and MarTech SaaS platforms. All workflow JSON is included. Store link at the end.

The Compliance Landscape for AdTech/MarTech SaaS in 2025

IAB TCF 2.2 and GDPR Article 6 — the consent string as a live document

The IAB TCF 2.2 specification (released April 2023) requires consent management platforms to issue consent strings that are specific to purpose codes 1–10. Purpose 1 (store and/or access information on a device) requires consent; Purpose 3 (create a personalized ads profile) requires consent; Purpose 4 (select personalized ads) requires consent. Bundled consent — one checkbox for all purposes — does not satisfy GDPR's 'specific' requirement under Art.7(2).

Each consent string carries an expiry. TCF 2.2 §8.5 requires CMPs to re-obtain consent after material changes to the purposes disclosed. A consent string that was valid at collection can become invalid if your platform adds a new processing purpose without re-prompting. Your automation pipeline must validate strings at the point of use, not just at the point of collection.

CCPA opt-out of sale and sharing — 15 business days, GPC signal mandatory

California Business and Professions Code §1798.135 (as amended by CPRA) requires businesses to process opt-out requests within 15 business days. Under §1798.135(b)(1), the Global Privacy Control signal must be treated as a valid opt-out of sale and sharing — it cannot be relegated to a secondary process or treated as lower priority than explicit opt-out clicks.

The 'sharing' amendment (effective Jan 1 2023) closed the 'no money changed hands' loophole. Cross-context behavioral advertising using third-party data — without money changing hands — is now 'sharing' under CPRA. Attribution platforms that pass behavioral segments to publisher partners for optimization purposes must handle the GPC signal accordingly.

COPPA 16 CFR §312.5 — the ad server as a primary violator

FTC enforcement history is clear: ad servers and ad networks that knowingly serve targeted ads to children under 13 are primary violators, not secondary actors. The 'knowingly' standard under §312.2 includes constructive knowledge — if the site's subject matter, visual content, music, animated characters, or celebrities popular with children indicate a child-directed audience, the platform cannot claim ignorance.

The FTC's Epic Games settlement ($520M, December 2022) and YouTube settlement ($170M, September 2019) establish that scaled enforcement is real. Your ad delivery pipeline must classify content before serving behavioral ads, not after the ad is delivered.

California AB 2273 Age-Appropriate Design Code — behavioral profiling of minors

AB 2273 (effective January 1, 2025) prohibits online services likely to be accessed by children under 18 from using default settings that enable profiling for behavioral advertising. This is opt-in for minors, not opt-out. Any ad platform serving California users across general consumer contexts must implement under-18 detection and profiling defaults before the ad is served.

FTC Endorsement Guides 16 CFR Part 255 — the 2023 revision expands coverage

The 2023 revision of 16 CFR Part 255 expanded FTC coverage to include: (1) social proof and fake reviews embedded in marketing platforms, (2) AI-generated endorsements and testimonials, (3) virtual influencers whose material connections are not disclosed, and (4) negative option and continuity marketing disguised as influencer-driven organic content. Influencer MarTech platforms that facilitate undisclosed sponsored content face potential secondary liability as platforms.

EU DSA Article 26 — recommender system transparency

DSA Art.26 requires online platforms to disclose to users the 'main parameters' used in recommender systems and to offer at least one option not based on profiling. For AdTech platforms operating recommender infrastructure (programmatic ad placement, personalized content curation), any algorithm change that materially affects the main parameters requires an update to the transparency disclosure. Very Large Online Platforms (>45M monthly EU users) face annual algorithmic accountability reporting under Art.27.

5 Production-Ready n8n Workflows

Workflow 1 — Tier-Segmented Onboarding Drip (7 AdTech Tiers)

Classifies new accounts into 7 tiers: ENTERPRISE_DSP_SSP, DMP_CDP_SAAS, ADSERVER_SAAS, ATTRIBUTION_ANALYTICS_SAAS, EMAIL_MARTECH_SAAS, INFLUENCER_MARTECH_SAAS, ADTECH_STARTUP. Routes each to a compliance-specific email sequence with tier-relevant regulations highlighted.

DSP/SSP tier: IAB TCF 2.2 consent string validation, GDPR Art.6(1)(a) per purpose code, EU DSA Art.26 recommender transparency. DMP/CDP tier: GDPR lawful basis per processing purpose, CCPA cross-context behavioral advertising opt-out, EU ePrivacy Directive cookie consent sequencing. Ad server tier: COPPA §312.5 content classification requirement, CA AB 2273 under-18 profiling default. Attribution tier: CCPA 'sharing' definition post-CPRA, GDPR Art.22 automated profiling right to explanation. Email MarTech: CAN-SPAM 10-day opt-out + CASL express consent + FTC Endorsement Guides 2023. Influencer MarTech: FTC 16 CFR Part 255 material connection disclosure, UK CAP Code §3.41 'Ad' labelling, EU DSA Art.26 commercial communications. Startup: IAB TCF 2.2 string requirement, CCPA §1798.135 GPC signal, EU ePrivacy cookie consent.

{
  "name": "AdTech Tier-Segmented Onboarding Drip \u2014 IAB TCF / GDPR / CCPA",
  "nodes": [
    {
      "id": "1",
      "name": "New AdTech Account Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "adtech-signup",
        "responseMode": "immediately",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Classify AdTech Tier",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "jsCode": "const b = $input.first().json.body || $input.first().json;\nconst tier = b.tier || 'ADTECH_STARTUP';\nconst flags = b.compliance_flags || [];\nconst hasEU = flags.includes('EU_GDPR_BEHAVIORAL_TARGETING') || b.eu_users === true;\nconst hasCAUsers = flags.includes('CCPA_OPT_OUT_REQUIRED') || b.ca_users === true;\nconst hasChildren = flags.includes('COPPA_UNDER_13') || b.children_audience === true;\nconst hasInfluencer = tier === 'INFLUENCER_MARTECH_SAAS';\nconst tcfRequired = flags.includes('IAB_TCF_22_PUBLISHER') || tier === 'ENTERPRISE_DSP_SSP';\n\nreturn [{\n  json: {\n    ...b,\n    tier,\n    has_eu_users: hasEU,\n    has_ca_users: hasCAUsers,\n    has_children: hasChildren,\n    tcf_required: tcfRequired,\n    influencer_platform: hasInfluencer,\n    onboarding_track: tier\n  }\n}];"
      }
    },
    {
      "id": "3",
      "name": "Route by Tier",
      "type": "n8n-nodes-base.switch",
      "typeVersion": 3,
      "position": [
        400,
        0
      ],
      "parameters": {
        "mode": "rules",
        "rules": {
          "values": [
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "ENTERPRISE_DSP_SSP"
                }
              }
            },
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "DMP_CDP_SAAS"
                }
              }
            },
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "ADSERVER_SAAS"
                }
              }
            },
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "ATTRIBUTION_ANALYTICS_SAAS"
                }
              }
            },
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "EMAIL_MARTECH_SAAS"
                }
              }
            },
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "INFLUENCER_MARTECH_SAAS"
                }
              }
            },
            {
              "conditions": {
                "options": {
                  "leftValue": "={{ $json.tier }}",
                  "operation": "equal",
                  "rightValue": "ADTECH_STARTUP"
                }
              }
            }
          ]
        }
      }
    },
    {
      "id": "4",
      "name": "DSP/SSP Email \u2014 TCF 2.2 + GDPR Art.6",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        -600
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "Your DSP/SSP compliance checklist \u2014 IAB TCF 2.2 + GDPR Art.6 + EU DSA Art.26",
        "message": "<p>Welcome to FlowKit. Your DSP/SSP platform touches three compliance boundaries simultaneously:</p><ul><li><strong>IAB TCF 2.2 consent string validation:</strong> Every bid request must carry a valid TCF consent string. Invalid or stale strings = GDPR Art.6 lawful basis failure for behavioral targeting. The IAB's own enforcement program (TCF 2.2 \u00a78.5) requires real-time string validation before data is passed downstream.</li><li><strong>GDPR Art.6(1)(a) for behavioral profiles:</strong> Consent must be specific, informed, and unambiguous. Pre-ticked boxes, bundled consent, or consent obtained before disclosure of all processing purposes = invalid. Each purpose code (1\u201310) must have individual consent or legitimate interest assessment.</li><li><strong>EU DSA Art.26 recommender system transparency:</strong> If your SSP runs a recommendation algorithm for ad placement, you must disclose the main parameters used. Large platforms (45M+ monthly EU users) face stricter obligations including annual algorithmic accountability reports.</li></ul><p>Your first 3 automations handle TCF string validation, GDPR consent audit, and DSA transparency logging. Setup guide attached.</p>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "5",
      "name": "DMP/CDP Email \u2014 GDPR Art.6 + CCPA + ePrivacy",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        -400
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "DMP/CDP compliance: GDPR Art.6 lawful basis + CCPA opt-out + EU ePrivacy cookie consent",
        "message": "<p>Your DMP/CDP ingests behavioral data from multiple sources. Three boundaries require immediate automation:</p><ul><li><strong>GDPR Art.6 lawful basis per processing purpose:</strong> Data onboarding, lookalike modeling, and third-party data enrichment each require a separate lawful basis assessment. A DMP cannot bundle them under a single consent. Each data source and each processing activity needs its own lawful basis record.</li><li><strong>CCPA opt-out of sale/sharing (15-day compliance):</strong> If any behavioral data segment is sold or shared for cross-context behavioral advertising, an opt-out signal (GPC or explicit opt-out) must be honored within 15 business days. \u00a71798.135(b)(1) \u2014 GPC signal from browser must be treated as opt-out request.</li><li><strong>EU ePrivacy Directive cookie/tracking consent:</strong> First-party and third-party cookies for behavioral profiling require prior consent (not opt-out). Pre-consent data collection = ePrivacy violation regardless of GDPR consent.</li></ul>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "6",
      "name": "AdServer Email \u2014 COPPA CARU + CA AB 2273",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        -200
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "Ad server compliance: COPPA \u00a7312.5 + California AB 2273 Age-Appropriate Design Code",
        "message": "<p>Your ad server may deliver ads to contexts where children are present. Two frameworks apply immediately:</p><ul><li><strong>COPPA 16 CFR \u00a7312.5:</strong> Ad servers that knowingly serve behavioral or targeted ads to children under 13 are direct violators \u2014 not just the app operator. 'Knowingly' = you have actual knowledge OR the site/app is directed to children (subject matter, music, animated characters, celebrities popular with children). FTC enforcement: Epic Games $520M (2023), YouTube $170M (2019). Your ad delivery pipeline must check content classification before serving targeted ads.</li><li><strong>California AB 2273 Age-Appropriate Design Code (effective Jan 2025):</strong> If your ad server serves California residents under 18, profiling by default is prohibited. Data minimization required for users under 18. Automated profiling for behavioral advertising requires explicit opt-in (not opt-out) for minors.</li></ul>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "7",
      "name": "Attribution Email \u2014 CCPA + GDPR Art.22",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        0
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "Attribution analytics compliance: CCPA cross-context behavioral + GDPR Art.22 automated profiling",
        "message": "<p>Attribution analytics platforms create compliance exposure at two points:</p><ul><li><strong>CCPA cross-context behavioral advertising (\u00a71798.140(k)):</strong> Attribution based on behavior across third-party websites or apps = 'sharing' under CPRA even without money exchanged. Must honor opt-out of sharing, not just opt-out of sale. This closes the 'no money changed hands' loophole that many attribution platforms have relied on.</li><li><strong>GDPR Art.22 automated decision-making:</strong> If attribution data is used to make automated decisions with legal or significant effects (ad spend allocation, publisher payment, fraud score), affected parties have a right to explanation and human review. Fully automated decisions = Art.22 obligation without explicit consent or contractual necessity basis.</li></ul>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "8",
      "name": "Email MarTech Email \u2014 CAN-SPAM + CASL + FTC",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        200
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "Email MarTech compliance: CAN-SPAM + CASL + FTC Endorsement Guides 16 CFR Part 255",
        "message": "<p>Email marketing platforms face three compliance stacks simultaneously:</p><ul><li><strong>CAN-SPAM + CASL unsubscribe mechanics:</strong> CAN-SPAM requires opt-out processing within 10 business days. CASL requires express consent before sending commercial email to Canadian recipients \u2014 implied consent expires after 2 years unless renewed. Your unsubscribe pipeline must handle both simultaneously.</li><li><strong>FTC Endorsement Guides 16 CFR Part 255 (revised 2023):</strong> Sponsored email content, affiliate links, and influencer-co-branded email campaigns require clear disclosure of material connections. The 2023 revision expanded coverage to social proof, ratings, and testimonials embedded in email marketing.</li><li><strong>GDPR email marketing consent:</strong> Legitimate interest cannot be used for direct marketing in most EU member states. Explicit opt-in required. Soft opt-in (prior business relationship) applies only to own similar products under strict conditions.</li></ul>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "9",
      "name": "Influencer MarTech Email \u2014 FTC + UK CAP",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        400
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "Influencer platform compliance: FTC 16 CFR Part 255 + UK CAP Code + EU DSA Art.26",
        "message": "<p>Influencer marketing platforms sit at the intersection of advertising disclosure law and platform liability:</p><ul><li><strong>FTC Endorsement Guides 16 CFR Part 255 (2023 revision):</strong> Material connections (payment, free products, affiliate relationships) must be clearly and conspicuously disclosed. 'Clear and conspicuous' = visible before consumer engagement, not buried in profile bio or #ad tag in a sea of other hashtags. Platforms that facilitate non-disclosed sponsored content face potential FTC enforcement as secondary actors.</li><li><strong>UK CAP Code (ASA) \u00a73.41:</strong> All influencer content with a material relationship must be labelled 'Ad' before any content in the post. 'Partner' or 'gifted' is insufficient \u2014 must say 'Ad'. ASA actively monitors and refers cases to Trading Standards.</li><li><strong>EU DSA Art.26:</strong> Commercial communications to EU users must be identifiable as such in real time. Platforms are required to ensure compliance by commercial account holders. Systemic non-compliance = very large platform (VLP) scrutiny.</li></ul>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "10",
      "name": "Startup Email \u2014 IAB TCF + CCPA + ePrivacy Starter",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        700,
        600
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.email }}",
        "subject": "AdTech startup compliance starter: IAB TCF 2.2 + CCPA opt-out + EU ePrivacy cookie consent",
        "message": "<p>Three compliance items to automate before your first campaign:</p><ul><li><strong>IAB TCF 2.2 consent string:</strong> If you integrate with any IAB-compliant DSP or SSP, you need a valid TCF string in every bid request. Invalid strings = bid rejection at the exchange level and potential partner liability. Free CMP integrations exist \u2014 the string generation is not optional.</li><li><strong>CCPA opt-out of sale (15 business days):</strong> If any behavioral data flows to third parties for advertising, the 'Do Not Sell or Share My Personal Information' link and GPC signal must be honored. Even if you are below the threshold for the California Privacy Rights Act, large publisher partners will require CCPA compliance as a contract term.</li><li><strong>EU ePrivacy cookie consent:</strong> Behavioral advertising cookies require prior consent in EU. Analytics-only cookies may use legitimate interest in some member states. Your cookie consent flow must be set up before any EU traffic reaches your ad pipeline.</li></ul>",
        "additionalFields": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "New AdTech Account Webhook": {
      "main": [
        [
          {
            "node": "Classify AdTech Tier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify AdTech Tier": {
      "main": [
        [
          {
            "node": "Route by Tier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route by Tier": {
      "main": [
        [
          {
            "node": "DSP/SSP Email \u2014 TCF 2.2 + GDPR Art.6",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "DMP/CDP Email \u2014 GDPR Art.6 + CCPA + ePrivacy",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "AdServer Email \u2014 COPPA CARU + CA AB 2273",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Attribution Email \u2014 CCPA + GDPR Art.22",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email MarTech Email \u2014 CAN-SPAM + CASL + FTC",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Influencer MarTech Email \u2014 FTC + UK CAP",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Startup Email \u2014 IAB TCF + CCPA + ePrivacy Starter",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 2 — IAB TCF 2.2 / CCPA / GDPR Consent Deadline Tracker

Daily 6AM UTC cron checks open consent obligation records. Tracks 10 clock types:

CCPA_OPT_OUT_OF_SALE_15_BIZ — 15 business days from opt-out request receipt §1798.135
CCPA_DELETION_REQUEST_45D — 45 calendar days from deletion request §1798.130
IAB_TCF_22_CONSENT_EXPIRY — 13-month maximum consent string validity
GDPR_ART6_LEGITIMATE_INTEREST_ANNUAL — annual balancing test review for Art.6(1)(f) legitimate interest
GDPR_DSARS_30D — 30-day DSAR response deadline from receipt
EU_EPRIVACY_CONSENT_EXPIRY — 6-month re-prompt interval for ePrivacy cookie consent
CCPA_ANNUAL_POLICY_UPDATE — privacy policy annual update §1798.130(a)(5)
CA_AB2273_ANNUAL_REVIEW — AB 2273 annual data protection impact assessment
FTC_ENDORSEMENT_DISCLOSURE_AUDIT — quarterly sponsored content audit 16 CFR Part 255
GDPR_ART22_CONSENT_ANNUAL — annual review of Art.22 automated profiling consent

Outputs CRITICAL (<24h), WARNING (<72h), WATCH (<168h) alerts to Slack #compliance-alerts.

{
  "name": "IAB TCF 2.2 / CCPA / GDPR Consent Compliance Deadline Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Daily Cron 6AM UTC",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 6 * * *"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Load Consent Obligation Queue",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT account_id, email, tier, obligation_type, trigger_ts, deadline_ts, status, hours_remaining FROM adtech_consent_obligations WHERE status = 'open' AND deadline_ts > NOW() ORDER BY deadline_ts ASC LIMIT 100"
      }
    },
    {
      "id": "3",
      "name": "Compute Time Windows",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const items = $input.all();\nconst now = new Date();\n\nconst OBLIGATION_CLOCKS = {\n  CCPA_OPT_OUT_OF_SALE_15_BIZ: { hours: 15*8, label: 'CCPA opt-out of sale \u00a71798.135 \u2014 15 business days', severity: 'HIGH' },\n  CCPA_DELETION_REQUEST_45D: { hours: 45*24, label: 'CCPA deletion request \u00a71798.130 \u2014 45 calendar days', severity: 'HIGH' },\n  IAB_TCF_22_CONSENT_EXPIRY: { hours: 13*30*24, label: 'IAB TCF 2.2 consent string expiry \u2014 13 months max', severity: 'MEDIUM' },\n  GDPR_ART6_LEGITIMATE_INTEREST_ANNUAL: { hours: 365*24, label: 'GDPR Art.6(1)(f) legitimate interest annual balancing test review', severity: 'MEDIUM' },\n  GDPR_DSARS_30D: { hours: 30*24, label: 'GDPR DSAR \u00a715 response \u2014 30 days', severity: 'HIGH' },\n  EU_EPRIVACY_CONSENT_EXPIRY: { hours: 6*30*24, label: 'EU ePrivacy cookie consent \u2014 6 months re-prompt', severity: 'MEDIUM' },\n  CCPA_ANNUAL_POLICY_UPDATE: { hours: 365*24, label: 'CCPA privacy policy annual update \u00a71798.130(a)(5)', severity: 'LOW' },\n  CA_AB2273_ANNUAL_REVIEW: { hours: 365*24, label: 'CA AB 2273 Age-Appropriate Design Code annual risk assessment', severity: 'MEDIUM' },\n  FTC_ENDORSEMENT_DISCLOSURE_AUDIT: { hours: 90*24, label: 'FTC 16 CFR Part 255 sponsored content audit \u2014 quarterly', severity: 'MEDIUM' },\n  GDPR_ART22_CONSENT_ANNUAL: { hours: 365*24, label: 'GDPR Art.22 automated profiling consent annual review', severity: 'MEDIUM' }\n};\n\nreturn items.map(item => {\n  const d = item.json;\n  const deadline = new Date(d.deadline_ts);\n  const hoursLeft = (deadline - now) / 3600000;\n  const clock = OBLIGATION_CLOCKS[d.obligation_type] || { label: d.obligation_type, severity: 'MEDIUM' };\n  let urgency = 'OK';\n  if (hoursLeft < 24) urgency = 'CRITICAL';\n  else if (hoursLeft < 72) urgency = 'WARNING';\n  else if (hoursLeft < 168) urgency = 'WATCH';\n  return { json: { ...d, hours_left: Math.round(hoursLeft), urgency, obligation_label: clock.label, severity: clock.severity } };\n}).filter(i => i.json.urgency !== 'OK');"
      }
    },
    {
      "id": "4",
      "name": "Filter Critical/Warning",
      "type": "n8n-nodes-base.filter",
      "typeVersion": 2.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "leftValue": "={{ $json.urgency }}",
            "operation": "notEqual",
            "rightValue": "OK"
          }
        }
      }
    },
    {
      "id": "5",
      "name": "Slack #compliance-alerts",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        800,
        0
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#compliance-alerts",
        "text": "\ud83d\udd14 AdTech Consent Deadline Alert \u2014 {{ $json.urgency }}\nAccount: {{ $json.account_id }} ({{ $json.tier }})\nObligation: {{ $json.obligation_label }}\nHours remaining: {{ $json.hours_left }}h\nDeadline: {{ $json.deadline_ts }}\nTriggered: {{ $json.trigger_ts }}"
      }
    }
  ],
  "connections": {
    "Daily Cron 6AM UTC": {
      "main": [
        [
          {
            "node": "Load Consent Obligation Queue",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load Consent Obligation Queue": {
      "main": [
        [
          {
            "node": "Compute Time Windows",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Compute Time Windows": {
      "main": [
        [
          {
            "node": "Filter Critical/Warning",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Filter Critical/Warning": {
      "main": [
        [
          {
            "node": "Slack #compliance-alerts",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 3 — AdTech Consent Infrastructure Health Monitor

Every 10 minutes, checks 5 consent infrastructure endpoints:

iab_tcf_cmp_api — TCF 2.2 CMP down = invalid consent strings in all bid requests = GDPR Art.6 lawful basis failure
ccpa_opt_out_api — CCPA opt-out pipeline down = 15-day clock running without processing
gdpr_consent_vault — GDPR consent records inaccessible = Art.7(1) demonstrating consent obligation unmet
coppa_age_classification_api — Age gate down = behavioral ads potentially reaching under-13 audience
gpc_signal_processor — GPC processor offline = CCPA §1798.135(b)(1) not being honored

PagerDuty alert on any downtime. A 10-minute outage in the TCF CMP API means 10 minutes of bid requests with unvalidated consent strings.

{
  "name": "AdTech Consent Infrastructure Health Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Every 10 Min",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "*/10 * * * *"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Check 5 Endpoints",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "jsCode": "const endpoints = [\n  { name: 'iab_tcf_cmp_api', url: process.env.TCF_CMP_API_URL || 'http://localhost:9001/health', risk: 'IAB TCF 2.2 consent string invalid in all bid requests \u2014 GDPR Art.6 lawful basis failure for behavioral targeting' },\n  { name: 'ccpa_opt_out_api', url: process.env.CCPA_OPT_OUT_API_URL || 'http://localhost:9002/health', risk: 'CCPA opt-out of sale pipeline down \u2014 15 business day clock running without processing \u00a71798.135' },\n  { name: 'gdpr_consent_vault', url: process.env.GDPR_CONSENT_VAULT_URL || 'http://localhost:9003/health', risk: 'GDPR consent records inaccessible \u2014 Art.7(1) demonstrating consent obligation unmet, Art.6 audit gap' },\n  { name: 'coppa_age_classification_api', url: process.env.COPPA_AGE_API_URL || 'http://localhost:9004/health', risk: 'COPPA age gate down \u2014 behavioral ads may reach under-13 audience, FTC enforcement risk (Epic $520M precedent)' },\n  { name: 'gpc_signal_processor', url: process.env.GPC_PROCESSOR_URL || 'http://localhost:9005/health', risk: 'GPC signal processor offline \u2014 CCPA \u00a71798.135(b)(1) opt-out of sharing not being honored, potential AG complaint' }\n];\nreturn endpoints.map(e => ({ json: e }));"
      }
    },
    {
      "id": "3",
      "name": "HTTP Health Checks",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "url": "={{ $json.url }}",
        "method": "GET",
        "options": {
          "timeout": 5000,
          "response": {
            "response": {
              "neverError": true
            }
          }
        }
      }
    },
    {
      "id": "4",
      "name": "Flag Failures",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        600,
        0
      ],
      "parameters": {
        "jsCode": "const result = $input.first().json;\nconst endpoint = $('Check 5 Endpoints').first().json;\nconst isDown = result.statusCode !== 200;\nif (!isDown) return [];\nreturn [{ json: { endpoint: endpoint.name, risk: endpoint.risk, status: result.statusCode || 'TIMEOUT', ts: new Date().toISOString() } }];"
      }
    },
    {
      "id": "5",
      "name": "PagerDuty Alert",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        800,
        0
      ],
      "parameters": {
        "url": "https://events.pagerduty.com/v2/enqueue",
        "method": "POST",
        "sendBody": true,
        "contentType": "json",
        "body": {
          "routing_key": "={{ $vars.PAGERDUTY_ROUTING_KEY }}",
          "event_action": "trigger",
          "payload": {
            "summary": "AdTech consent infra DOWN: {{ $json.endpoint }} \u2014 {{ $json.risk }}",
            "severity": "critical",
            "source": "n8n-adtech-monitor",
            "timestamp": "={{ $json.ts }}"
          }
        }
      }
    }
  ],
  "connections": {
    "Every 10 Min": {
      "main": [
        [
          {
            "node": "Check 5 Endpoints",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check 5 Endpoints": {
      "main": [
        [
          {
            "node": "HTTP Health Checks",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Health Checks": {
      "main": [
        [
          {
            "node": "Flag Failures",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Flag Failures": {
      "main": [
        [
          {
            "node": "PagerDuty Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 4 — AdTech Consent Violation Incident Pipeline

Webhook receives consent events and classifies them into 8 incident types with pre-calculated deadlines:

Event	Deadline	Action
IAB_TCF_INVALID_CONSENT_STRING	IMMEDIATE	Suspend bid requests — invalid string = GDPR Art.6 failure
CCPA_OPT_OUT_REQUEST_RECEIVED	15 business days	Honor signal, stop sale/sharing of PI
GDPR_CONSENT_WITHDRAWAL	IMMEDIATE	Stop processing based on consent, delete derived profiles
COPPA_UNDER13_DETECTED	IMMEDIATE	Remove from behavioral targeting, switch to contextual only
FTC_ENDORSEMENT_UNDISCLOSED	IMMEDIATE	Add disclosure or suspend campaign
GPC_SIGNAL_RECEIVED	15 business days	Treat as CCPA opt-out of sharing §1798.135(b)(1)
CA_AB2273_PROFILING_MINOR	IMMEDIATE	Remove from profiling pipeline, default to age-appropriate settings
GDPR_ART26_RECOMMENDER_CHANGE	72 hours	Update DSA Art.26 transparency disclosure

The IMMEDIATE category covers four of the eight incident types. Each IMMEDIATE event has a zero-hour deadline — the clock started when your system received the event, not when a human opened a ticket.

{
  "name": "AdTech Consent Violation Incident Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "Consent Event Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "consent-incident",
        "responseMode": "immediately",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Classify Incident",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "jsCode": "const b = $input.first().json.body || $input.first().json;\nconst type = b.event_type;\nconst accountId = b.account_id;\nconst receivedAt = new Date().toISOString();\n\nconst INCIDENT_MAP = {\n  IAB_TCF_INVALID_CONSENT_STRING: { deadline_hours: 1, label: 'IAB TCF 2.2 invalid consent string in bid request', action: 'SUSPEND_BID_REQUESTS \u2014 invalid string = GDPR Art.6 failure for all downstream behavioral targeting', severity: 'CRITICAL' },\n  CCPA_OPT_OUT_REQUEST_RECEIVED: { deadline_hours: 15*8, label: 'CCPA opt-out of sale request received \u00a71798.135', action: 'INITIATE_15_BUSINESS_DAY_CLOCK \u2014 honor signal, stop sale/sharing of PI', severity: 'HIGH' },\n  GDPR_CONSENT_WITHDRAWAL: { deadline_hours: 0, label: 'GDPR Art.7(3) consent withdrawal', action: 'IMMEDIATE \u2014 stop processing based on consent, delete derived profiles per Art.17', severity: 'CRITICAL' },\n  COPPA_UNDER13_DETECTED: { deadline_hours: 0, label: 'COPPA under-13 user detected in behavioral ad pipeline', action: 'IMMEDIATE \u2014 remove from behavioral targeting, delete PI per \u00a7312.10, switch to contextual ads only', severity: 'CRITICAL' },\n  FTC_ENDORSEMENT_UNDISCLOSED: { deadline_hours: 0, label: 'FTC 16 CFR Part 255 undisclosed sponsorship detected', action: 'IMMEDIATE \u2014 add disclosure or suspend campaign, log remediation timestamp', severity: 'HIGH' },\n  GPC_SIGNAL_RECEIVED: { deadline_hours: 15*8, label: 'GPC opt-out signal received \u00a71798.135(b)(1)', action: 'INITIATE_15_BUSINESS_DAY_CLOCK \u2014 treat as CCPA opt-out of sharing', severity: 'HIGH' },\n  CA_AB2273_PROFILING_MINOR: { deadline_hours: 0, label: 'CA AB 2273 automated profiling of user under 18 without opt-in', action: 'IMMEDIATE \u2014 remove from profiling pipeline, switch to age-appropriate default settings', severity: 'CRITICAL' },\n  GDPR_ART26_RECOMMENDER_CHANGE: { deadline_hours: 72, label: 'EU DSA Art.26 recommender system parameter change without disclosure update', action: '72H \u2014 update system transparency disclosure per Art.27', severity: 'MEDIUM' }\n};\n\nconst incident = INCIDENT_MAP[type] || { deadline_hours: 24, label: type, action: 'REVIEW_REQUIRED', severity: 'MEDIUM' };\nconst deadlineAt = incident.deadline_hours === 0 ? receivedAt : new Date(Date.now() + incident.deadline_hours * 3600000).toISOString();\n\nreturn [{\n  json: {\n    account_id: accountId,\n    event_type: type,\n    incident_label: incident.label,\n    action: incident.action,\n    severity: incident.severity,\n    received_at: receivedAt,\n    deadline_at: deadlineAt,\n    deadline_hours: incident.deadline_hours\n  }\n}];"
      }
    },
    {
      "id": "3",
      "name": "Slack #adtech-incidents",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        400,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#adtech-incidents",
        "text": "\ud83d\udea8 AdTech Consent Incident \u2014 {{ $json.severity }}\nType: {{ $json.event_type }}\nAccount: {{ $json.account_id }}\nIncident: {{ $json.incident_label }}\nAction: {{ $json.action }}\nDeadline: {{ $json.deadline_at }} ({{ $json.deadline_hours }}h)\nReceived: {{ $json.received_at }}"
      }
    },
    {
      "id": "4",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        400,
        100
      ],
      "parameters": {
        "operation": "insert",
        "schema": "public",
        "table": "adtech_consent_incidents",
        "dataMode": "autoMapInputData"
      }
    }
  ],
  "connections": {
    "Consent Event Webhook": {
      "main": [
        [
          {
            "node": "Classify Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Incident": {
      "main": [
        [
          {
            "node": "Slack #adtech-incidents",
            "type": "main",
            "index": 0
          },
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 5 — Weekly AdTech Compliance KPI Dashboard

Monday 8AM ET, emails CEO + DPO. Queries account database for:

Accounts by tier and MRR
Average IAB TCF 2.2 consent string valid percentage
CCPA opt-outs processed in last 7 days
Open GDPR DSARs
COPPA under-13 flags in last 7 days
FTC disclosure violations detected

A COPPA flag in the KPI report is not a metric to improve — it is a $51,744/violation FTC exposure item. The report surface makes that visible to the CEO every Monday.

{
  "name": "Weekly AdTech Compliance KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 8AM ET",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.1,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 13 * * 1"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Query KPI Data",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT tier, COUNT(*) as accounts, SUM(mrr_usd) as mrr, SUM(tcf_valid_consent_pct) / COUNT(*) as avg_tcf_valid_pct, SUM(ccpa_opt_outs_7d) as ccpa_opt_outs, SUM(gdpr_dsars_open) as open_dsars, SUM(coppa_flags_7d) as coppa_flags, SUM(ftc_disclosure_violations_7d) as ftc_violations FROM adtech_accounts GROUP BY tier ORDER BY mrr DESC"
      }
    },
    {
      "id": "3",
      "name": "Build KPI Report",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const rows = $input.all().map(i => i.json);\nconst totalMRR = rows.reduce((s, r) => s + (r.mrr || 0), 0);\nconst totalAccounts = rows.reduce((s, r) => s + (r.accounts || 0), 0);\nconst totalCCPAOptOuts = rows.reduce((s, r) => s + (r.ccpa_opt_outs || 0), 0);\nconst openDSARs = rows.reduce((s, r) => s + (r.open_dsars || 0), 0);\nconst coppaFlags = rows.reduce((s, r) => s + (r.coppa_flags || 0), 0);\nconst ftcViolations = rows.reduce((s, r) => s + (r.ftc_violations || 0), 0);\n\nlet tierBreakdown = rows.map(r =>\n  `${r.tier}: ${r.accounts} accounts | MRR $${(r.mrr||0).toLocaleString()} | TCF valid ${(r.avg_tcf_valid_pct||0).toFixed(1)}% | CCPA opt-outs ${r.ccpa_opt_outs||0} | COPPA flags ${r.coppa_flags||0}`\n).join('\\n');\n\nconst body = `Weekly AdTech Compliance KPI \u2014 ${new Date().toISOString().slice(0,10)}\n\nTOTAL: ${totalAccounts} accounts | MRR $${totalMRR.toLocaleString()}\nCCPA opt-outs this week: ${totalCCPAOptOuts}\nOpen GDPR DSARs: ${openDSARs}\nCOPPA flags: ${coppaFlags}\nFTC disclosure violations: ${ftcViolations}\n\nBy Tier:\n${tierBreakdown}\n\nCritical compliance reminders:\n- IAB TCF 2.2: invalid consent strings in bid requests = GDPR Art.6 failure \u2014 check TCF valid % above\n- CCPA 15 biz day opt-out clock: any CCPA_OPT_OUT_OF_SALE events this week? Check incident log\n- COPPA: ${coppaFlags} under-13 flags this week \u2014 each is potential $51,744/violation FTC exposure\n- GDPR open DSARs: ${openDSARs} open \u2014 30-day deadline applies from receipt`;\n\nreturn [{ json: { report: body } }];"
      }
    },
    {
      "id": "4",
      "name": "Email CEO + DPO",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $vars.CEO_EMAIL }}",
        "subject": "Weekly AdTech Compliance KPI \u2014 {{ $now.format('YYYY-MM-DD') }}",
        "message": "<pre>{{ $json.report }}</pre>",
        "additionalFields": {
          "ccList": "={{ $vars.DPO_EMAIL }}",
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "Monday 8AM ET": {
      "main": [
        [
          {
            "node": "Query KPI Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query KPI Data": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Report": {
      "main": [
        [
          {
            "node": "Email CEO + DPO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The Architectural Problem in AdTech Consent Infrastructure

Cloud iPaaS automation pipelines create a specific consent compliance risk for AdTech platforms: the consent record is on the vendor's infrastructure, and the vendor's retention policy governs how long the record exists.

Under GDPR Art.7(1), the controller must be able to demonstrate that the data subject consented. If the consent record is in a cloud automation vendor's log — with a 90-day retention policy — and enforcement comes 18 months after collection, the consent record no longer exists. The burden of proof under Art.7(1) shifts to the controller, and 'the vendor deleted it' is not a valid defense.

The same issue applies to CCPA opt-out receipts. If a GPC signal was received by your cloud automation pipeline and the vendor log purged it, you cannot prove the 15-day clock started when it did — or that you honored it.

Self-hosted n8n keeps all consent records, timestamps, and processing logs under your infrastructure with your retention policy. The consent audit trail is yours, not your vendor's.

Four self-hosting arguments specific to AdTech:

GDPR Art.7(1) consent demonstration: Consent records on vendor infrastructure with vendor retention policy — not under your control
CCPA GPC signal receipt timestamp: Cloud automation vendor log is the only record of when GPC was received — becomes your legal timestamp
COPPA 'knowingly' standard: Content classification pipeline logs on vendor infra = vendor timestamps are the FTC's evidence of when you had constructive knowledge
IAB TCF 2.2 consent string audit: TCF invalid string events in vendor logs — your partner dispute evidence is subject to vendor retention policy

Get All 5 Workflows + the Full AdTech Compliance Bundle

All 5 workflow JSON files are available individually or as part of the FlowKit n8n Automation Templates bundle.

Individual templates: $12–$29 each at stripeai.gumroad.com

Full bundle (15 templates): $97 at stripeai.gumroad.com

Each template includes the complete n8n workflow JSON, a setup guide, and configuration notes for the compliance-specific parameters (TCF CMP endpoint, CCPA opt-out webhook URL, GDPR consent vault connection, COPPA age classification API).

n8n for MediaTech & Streaming SaaS: 5 Automations for DSA, DMCA, AVMSD, and COPPA Compliance (Free Workflow JSON)

Alex Kane — Thu, 28 May 2026 23:03:32 +0000

If your platform hosts user-generated video, audio, or social content, 2024–2025 is the year regulators caught up to the scale of the problem.

EU Digital Services Act Art.14 (illegal content): very large online platforms (VLOPs >45M EU users) had DSA obligations from August 2023. All platforms with EU users face DSA compliance by February 2024. Illegal content — CSAM, terrorist content, counterfeit goods — must be removed or disabled access expeditiously. In practice: 24 hours is the operational target for flagged illegal content.

DMCA §512 safe harbor requires expeditious removal after a valid takedown notice. The counter-notice window is 10–14 business days. Miss either window and you lose safe harbor protection — leaving you liable for statutory damages of $750–$150,000 per infringed work.

EU Copyright Directive Art.17 (formerly Art.13): platforms with >3 years operating + >10M EUR annual revenue must implement upload filters. Failure to prevent unauthorized uploads means the platform — not the user — is directly liable for infringement.

AVMSD Art.13 (Audiovisual Media Services Directive): VOD platforms must ensure at least 30% of their catalogue is European-origin content and must contribute financially to European production. National regulators (Ofcom, CSA, AGCOM) enforce this — sanctions vary by member state.

COPPA 16 CFR Part 312: any platform collecting PII from users under 13 must obtain verifiable parental consent first. FTC penalty: up to $51,744 per violation. CARU (Children's Advertising Review Unit) runs the industry self-regulatory program. Short-form video platforms with teen audiences face the highest exposure.

GDPR Art.22: automated profiling that produces legal or similarly significant effects requires opt-in consent or explicit legitimate basis. Recommendation engines and ad targeting systems that process behavioral data fall here.

Self-hosted n8n handles all five operational loops without routing user-generated content, PII, or rights-holder data through a third-party cloud iPaaS.

Who this is for

Tier	Example	Primary pain
ENTERPRISE_STREAMING_SAAS	Netflix-scale VOD platforms	AVMSD 30% quota + DSA VLOP obligations
VIDEO_PLATFORM_SAAS	UGC video hosting platforms	DMCA §512 + Art.17 upload filter
PODCAST_PLATFORM_SAAS	Podcast hosting/distribution	DMCA §512 + FTC Endorsement Guides disclosure
LIVE_STREAMING_SAAS	Live streaming platforms	DSA Art.14 24h + COPPA teen audience
SHORT_FORM_VIDEO_SAAS	Short-form video apps	COPPA + DSA + GDPR Art.22 profiling
CREATOR_MONETIZATION_SAAS	Creator revenue/sponsorship platforms	FTC Endorsement Guides 16 CFR Part 255
MEDIATECH_STARTUP	New media/content tech entrants	DMCA + COPPA baseline + DSA readiness

Workflow 1 — DSA/DMCA Content Takedown & Notice Pipeline

Regulations: EU DSA Art.14 (24-hour illegal content removal) + DMCA §512 safe harbor (expeditious removal)

Why it matters: DSA Art.14 requires platforms to act on notices of illegal content. DMCA §512 requires expeditious removal after valid copyright notice and a 10-14 day counter-notice window. Both require documented receipt timestamps for compliance audit trails. Manual review queues miss deadlines under volume.

{
  "name": "DSA/DMCA Content Takedown & Notice Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "Content Report Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "content-report",
        "responseMode": "responseNode",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Classify Report",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "jsCode": "const b = $input.first().json.body || $input.first().json;\nconst type = b.report_type || 'unknown';\nconst contentId = b.content_id;\nconst reporterEmail = b.reporter_email;\nconst platformJurisdiction = b.jurisdiction || 'EU'; // EU triggers DSA\n\nlet deadline_hours = null;\nlet framework = null;\n\nif (platformJurisdiction === 'EU' && type === 'illegal_content') {\n  framework = 'EU_DSA_ART14';\n  deadline_hours = 24;\n} else if (type === 'copyright_dmca') {\n  framework = 'DMCA_512';\n  deadline_hours = 10 * 24; // 10 business days ~= conservative 10 days\n} else if (type === 'copyright_eu') {\n  framework = 'EU_COPYRIGHT_DIR_ART17';\n  deadline_hours = 24;\n} else {\n  framework = 'INTERNAL_REVIEW';\n  deadline_hours = 72;\n}\n\nconst receivedAt = new Date().toISOString();\nconst deadlineAt = new Date(Date.now() + deadline_hours*3600*1000).toISOString();\n\nreturn [{\n  json: {\n    content_id: contentId,\n    reporter_email: reporterEmail,\n    framework,\n    deadline_hours,\n    deadline_at: deadlineAt,\n    received_at: receivedAt,\n    jurisdiction: platformJurisdiction,\n    report_type: type\n  }\n}];"
      }
    },
    {
      "id": "3",
      "name": "Slack Trust & Safety",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        400,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#trust-safety",
        "text": "\ud83d\udea8 CONTENT REPORT \u2014 {{ $json.framework }}\nContent ID: {{ $json.content_id }}\nFramework: {{ $json.framework }}\nDeadline: {{ $json.deadline_at }} ({{ $json.deadline_hours }}h)\nReceived: {{ $json.received_at }}\nAction required: Review + takedown decision before deadline"
      }
    },
    {
      "id": "4",
      "name": "Gmail Reporter ACK",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        400,
        100
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.reporter_email }}",
        "subject": "Your report has been received \u2014 {{ $json.content_id }}",
        "message": "<p>Thank you for your report. We have received your {{ $json.report_type }} notice regarding content ID {{ $json.content_id }}.</p><p>We will review your report and take action in accordance with {{ $json.framework === 'EU_DSA_ART14' ? 'EU DSA Article 14 (24-hour deadline)' : $json.framework === 'DMCA_512' ? 'DMCA \u00a7512 (expeditious removal)' : 'our content policy' }}.</p><p>Reference: {{ $json.content_id }}-{{ $json.received_at }}</p>",
        "additionalFields": {
          "isHtml": true
        }
      }
    },
    {
      "id": "5",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        600,
        0
      ],
      "parameters": {
        "operation": "insert",
        "schema": "public",
        "table": "content_takedown_log",
        "dataMode": "autoMapInputData"
      }
    }
  ],
  "connections": {
    "Content Report Webhook": {
      "main": [
        [
          {
            "node": "Classify Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Report": {
      "main": [
        [
          {
            "node": "Slack Trust & Safety",
            "type": "main",
            "index": 0
          },
          {
            "node": "Gmail Reporter ACK",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack Trust & Safety": {
      "main": [
        [
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Import this: Copy the JSON above → n8n → Import from clipboard.

Workflow 2 — EU Copyright Directive Art.17 Upload Filter & Rights-Holder Notice

Regulation: EU Copyright Directive Art.17 (formerly Art.13) — upload filter obligation

Why it matters: Platforms with >3 years operating and >10M EUR annual revenue must implement upload filters and prevent unauthorized uploads. When a match is detected, the platform must hold the content and notify the rights holder. Liability shifts to the platform if the filter is absent.

{
  "name": "EU Copyright Dir. Art.17 Upload Filter & Rights-Holder Notice",
  "nodes": [
    {
      "id": "1",
      "name": "Video Upload Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "video-uploaded",
        "responseMode": "immediately",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Check ContentID Database",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "url": "={{ $vars.CONTENT_ID_API_URL }}/check",
        "method": "POST",
        "sendBody": true,
        "contentType": "json",
        "body": {
          "video_id": "={{ $json.body.video_id }}",
          "fingerprint": "={{ $json.body.audio_fingerprint }}"
        }
      }
    },
    {
      "id": "3",
      "name": "Copyright Match Check",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.1,
      "position": [
        400,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "leftValue": "={{ $json.match_found }}",
            "operation": "equal",
            "rightValue": true
          }
        }
      }
    },
    {
      "id": "4",
      "name": "Hold Content + Notify Rights Holder",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        600,
        -100
      ],
      "parameters": {
        "jsCode": "const match = $input.first().json;\nconst videoId = $('Video Upload Webhook').first().json.body.video_id;\nconst uploaderId = $('Video Upload Webhook').first().json.body.uploader_id;\nconst rightsHolder = match.rights_holder_email;\nconst matchedWork = match.matched_work_title;\n\n// EU Copyright Directive Art.17: platform must prevent availability\n// unless license obtained OR uploader provides valid counter-notice\nconst holdUntil = new Date(Date.now() + 14*24*3600*1000).toISOString();\n\nreturn [{\n  json: {\n    video_id: videoId,\n    uploader_id: uploaderId,\n    rights_holder_email: rightsHolder,\n    matched_work: matchedWork,\n    hold_until: holdUntil,\n    action: 'CONTENT_HELD_PENDING_REVIEW',\n    regulation: 'EU Copyright Directive Art.17 \u2014 upload filter mandatory for platforms >3yr+>10M EUR revenue',\n    counter_notice_deadline: holdUntil\n  }\n}];"
      }
    },
    {
      "id": "5",
      "name": "Slack Content Ops",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        800,
        -200
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#content-ops",
        "text": "\u26a0\ufe0f Art.17 UPLOAD FILTER MATCH\nVideo: {{ $json.video_id }}\nMatched work: {{ $json.matched_work }}\nAction: Content held pending review\nHold until: {{ $json.hold_until }}\nRegulation: EU Copyright Directive Art.17"
      }
    },
    {
      "id": "6",
      "name": "Gmail Rights Holder Notice",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        800,
        0
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.rights_holder_email }}",
        "subject": "Upload filter match notice \u2014 {{ $json.matched_work }}",
        "message": "<p>Our automated upload filter has detected a potential match with your work: <strong>{{ $json.matched_work }}</strong>.</p><p>Video ID {{ $json.video_id }} has been held pending review as required under EU Copyright Directive Article 17.</p><p>The uploader has until {{ $json.hold_until }} to submit a counter-notice. You will be notified of the outcome.</p>",
        "additionalFields": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "Video Upload Webhook": {
      "main": [
        [
          {
            "node": "Check ContentID Database",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check ContentID Database": {
      "main": [
        [
          {
            "node": "Copyright Match Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Copyright Match Check": {
      "main": [
        [
          {
            "node": "Hold Content + Notify Rights Holder",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Hold Content + Notify Rights Holder": {
      "main": [
        [
          {
            "node": "Slack Content Ops",
            "type": "main",
            "index": 0
          },
          {
            "node": "Gmail Rights Holder Notice",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 3 — AVMSD 30% EU Content Quota & Commissioning Tracker

Regulation: EU AVMSD Art.13 — 30% European-origin content catalogue requirement

Why it matters: VOD platforms operating in EU member states must maintain at least 30% EU-origin content in their catalogue and contribute financially to European audiovisual production. National content regulators track this quarterly. Platforms that slip below 30% risk licensing conditions or financial levies.

{
  "name": "AVMSD 30% EU Content Quota & Commissioning Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Weekly Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "weeks",
              "triggerAtDay": [
                1
              ],
              "triggerAtHour": 8
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Content Catalog",
      "type": "n8n-nodes-base.googleSheets",
      "typeVersion": 4.4,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "read",
        "documentId": "={{ $vars.CONTENT_CATALOG_SHEET_ID }}",
        "sheetName": "Catalog",
        "filtersUI": {}
      }
    },
    {
      "id": "3",
      "name": "Calculate EU Quota",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const items = $input.all().map(i => i.json);\nconst total = items.length;\nconst euOrigin = items.filter(i => i.eu_origin === 'true' || i.eu_origin === true).length;\nconst euPct = total > 0 ? Math.round(euOrigin / total * 100) : 0;\n\n// AVMSD Art.13 + Recital 35: at least 30% of catalogue must be EU-origin\n// Applies to VOD services with >10M EUR annual revenue in EU\nconst AVMSD_THRESHOLD = 30;\nconst shortfall = Math.max(0, AVMSD_THRESHOLD - euPct);\nconst titlesNeeded = Math.max(0, Math.ceil(total * 0.30) - euOrigin);\n\nconst commissionQueue = items.filter(i => i.status === 'COMMISSION_PIPELINE' && i.eu_origin === 'true');\n\nreturn [{\n  json: {\n    total_titles: total,\n    eu_origin_titles: euOrigin,\n    eu_pct: euPct,\n    avmsd_threshold_pct: AVMSD_THRESHOLD,\n    compliant: euPct >= AVMSD_THRESHOLD,\n    shortfall_pct: shortfall,\n    titles_needed_to_comply: titlesNeeded,\n    eu_titles_in_pipeline: commissionQueue.length,\n    checked_at: new Date().toISOString()\n  }\n}];"
      }
    },
    {
      "id": "4",
      "name": "Quota Compliance Check",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "leftValue": "={{ $json.compliant }}",
            "operation": "equal",
            "rightValue": false
          }
        }
      }
    },
    {
      "id": "5",
      "name": "Slack Content Strategy Alert",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        800,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#content-strategy",
        "text": "\u26a0\ufe0f AVMSD EU CONTENT QUOTA SHORTFALL\nCurrent EU %: {{ $json.eu_pct }}% (minimum 30% required)\nShortfall: {{ $json.shortfall_pct }}%\nTitles needed to comply: {{ $json.titles_needed_to_comply }}\nEU titles in commission pipeline: {{ $json.eu_titles_in_pipeline }}\nRegulation: AVMSD Art.13 (Audiovisual Media Services Directive)\nRisk: NCA enforcement + potential service restriction in EU member states"
      }
    },
    {
      "id": "6",
      "name": "Gmail CEO Report",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        800,
        100
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $vars.CEO_EMAIL }}",
        "subject": "Weekly AVMSD EU Content Quota Report \u2014 {{ $json.eu_pct }}% EU Origin",
        "message": "<h3>AVMSD EU Content Quota \u2014 Weekly Report</h3><p>EU-origin titles: <strong>{{ $json.eu_origin_titles }}</strong> / {{ $json.total_titles }} total (<strong>{{ $json.eu_pct }}%</strong>)</p><p>AVMSD Art.13 minimum: <strong>30%</strong></p><p>Status: <strong>{{ $json.compliant ? '\u2705 COMPLIANT' : '\u26a0\ufe0f SHORTFALL \u2014 ' + $json.shortfall_pct + '% below threshold' }}</strong></p><p>Titles needed to reach 30%: {{ $json.titles_needed_to_comply }}</p><p>EU titles in commission pipeline: {{ $json.eu_titles_in_pipeline }}</p>",
        "additionalFields": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "Weekly Monday 8AM": {
      "main": [
        [
          {
            "node": "Fetch Content Catalog",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Content Catalog": {
      "main": [
        [
          {
            "node": "Calculate EU Quota",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Calculate EU Quota": {
      "main": [
        [
          {
            "node": "Quota Compliance Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Quota Compliance Check": {
      "main": [
        [
          {
            "node": "Slack Content Strategy Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Gmail CEO Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Workflow 4 — COPPA Under-13 Detection & Parental Consent Pipeline

Regulations: COPPA 16 CFR Part 312 + CARU Self-Regulatory Program

Why it matters: Platforms directed to children or with actual knowledge of under-13 users must obtain verifiable parental consent before collecting PII. The FTC has levied penalties exceeding $150M against large platforms. Short-form video platforms are highest-risk. Manual review of age signals at scale is impossible — automated flagging is the only viable approach.

{
  "name": "COPPA Under-13 Detection & Parental Consent Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "New Signup Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "path": "new-signup",
        "responseMode": "immediately",
        "httpMethod": "POST"
      }
    },
    {
      "id": "2",
      "name": "Age Verification Check",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "jsCode": "const b = $input.first().json.body || $input.first().json;\nconst dob = b.date_of_birth; // YYYY-MM-DD\nconst userId = b.user_id;\nconst parentEmail = b.parent_email || null;\nconst selfReportedAge = parseInt(b.age || '99');\n\nlet ageRiskFlag = 'ADULT';\nlet ageYears = null;\n\nif (dob) {\n  const birthDate = new Date(dob);\n  const today = new Date();\n  ageYears = (today - birthDate) / (365.25 * 24 * 3600 * 1000);\n  if (ageYears < 13) ageRiskFlag = 'UNDER_13_CONFIRMED';\n  else if (ageYears < 16) ageRiskFlag = 'TEEN_13_15';\n} else if (selfReportedAge < 13) {\n  ageRiskFlag = 'UNDER_13_SELF_REPORTED';\n} else if (selfReportedAge < 16) {\n  ageRiskFlag = 'TEEN_SIGNAL';\n}\n\n// COPPA 16 CFR Part 312: operators must obtain verifiable parental consent\n// before collecting PII from children under 13\n// CARU (Children's Advertising Review Unit) self-regulatory supplement\n\nreturn [{\n  json: {\n    user_id: userId,\n    age_risk_flag: ageRiskFlag,\n    age_years: ageYears ? Math.floor(ageYears) : null,\n    parent_email: parentEmail,\n    requires_parental_consent: ageRiskFlag.includes('UNDER_13'),\n    regulation: 'COPPA 16 CFR Part 312 + CARU Self-Regulatory Program',\n    action_required: ageRiskFlag.includes('UNDER_13') ? 'PAUSE_ACCOUNT_PENDING_PARENTAL_CONSENT' : 'STANDARD_ONBOARDING',\n    flagged_at: new Date().toISOString()\n  }\n}];"
      }
    },
    {
      "id": "3",
      "name": "Under-13 Flag Check",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.1,
      "position": [
        400,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "leftValue": "={{ $json.requires_parental_consent }}",
            "operation": "equal",
            "rightValue": true
          }
        }
      }
    },
    {
      "id": "4",
      "name": "Pause Account + Notify Ops",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        600,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#trust-safety-coppa",
        "text": "\ud83d\udea8 COPPA FLAG \u2014 UNDER-13 SIGNUP\nUser ID: {{ $json.user_id }}\nAge flag: {{ $json.age_risk_flag }}\nAction: Account paused pending verifiable parental consent\nRegulation: COPPA 16 CFR Part 312\nFTC penalty: up to $51,744/violation\nParent email available: {{ $json.parent_email ? 'YES' : 'NO \u2014 manual review required' }}"
      }
    },
    {
      "id": "5",
      "name": "Gmail Parental Consent Request",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        600,
        100
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $json.parent_email || $vars.COPPA_REVIEW_EMAIL }}",
        "subject": "Parental consent required for your child's account",
        "message": "<p>We detected that a user on our platform may be under 13 years old. Under the Children's Online Privacy Protection Act (COPPA), we are required to obtain verifiable parental consent before collecting any personal information from children under 13.</p><p>To activate this account, a parent or guardian must complete our consent form: <a href='{{ $vars.COPPA_CONSENT_URL }}?uid={{ $json.user_id }}'>Click here to provide consent</a></p><p>If you did not create this account, please ignore this email and the account will be automatically deleted after 30 days.</p>",
        "additionalFields": {
          "isHtml": true
        }
      }
    }
  ],
  "connections": {
    "New Signup Webhook": {
      "main": [
        [
          {
            "node": "Age Verification Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Age Verification Check": {
      "main": [
        [
          {
            "node": "Under-13 Flag Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Under-13 Flag Check": {
      "main": [
        [
          {
            "node": "Pause Account + Notify Ops",
            "type": "main",
            "index": 0
          },
          {
            "node": "Gmail Parental Consent Request",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}

Workflow 5 — Weekly MediaTech Platform KPI Dashboard

Why it matters: DAU/MAU, watch hours, creator activity, revenue, and compliance event counts all in one weekly email. The BCC to Legal closes the governance gap — your legal team sees the same compliance numbers the CEO sees, every Monday.

{
  "name": "Weekly MediaTech Platform KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "weeks",
              "triggerAtDay": [
                1
              ],
              "triggerAtHour": 8
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Platform Metrics",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT SUM(CASE WHEN event_date >= NOW() - INTERVAL '7 days' THEN 1 ELSE 0 END) AS dau_7d, COUNT(DISTINCT user_id) AS mau_30d, SUM(content_hours_watched) AS total_watch_hours_7d, COUNT(DISTINCT creator_id) AS active_creators_7d, SUM(revenue_usd) AS revenue_7d, SUM(CASE WHEN event_date >= NOW() - INTERVAL '14 days' AND event_date < NOW() - INTERVAL '7 days' THEN revenue_usd ELSE 0 END) AS revenue_prev_7d FROM platform_metrics_weekly WHERE event_date >= NOW() - INTERVAL '30 days'"
      }
    },
    {
      "id": "3",
      "name": "Fetch Compliance Events",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        200
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(CASE WHEN framework = 'EU_DSA_ART14' THEN 1 END) AS dsa_notices_7d, COUNT(CASE WHEN framework = 'DMCA_512' THEN 1 END) AS dmca_notices_7d, COUNT(CASE WHEN framework = 'EU_COPYRIGHT_DIR_ART17' THEN 1 END) AS art17_matches_7d, COUNT(CASE WHEN age_risk_flag LIKE '%UNDER_13%' THEN 1 END) AS coppa_flags_7d, MAX(eu_content_pct) AS current_eu_content_pct FROM compliance_events_log WHERE event_date >= NOW() - INTERVAL '7 days'"
      }
    },
    {
      "id": "4",
      "name": "Merge Metrics",
      "type": "n8n-nodes-base.merge",
      "typeVersion": 3,
      "position": [
        400,
        100
      ],
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByPosition"
      }
    },
    {
      "id": "5",
      "name": "Build KPI Report",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        600,
        100
      ],
      "parameters": {
        "jsCode": "const m = $input.first().json;\nconst prev = parseFloat(m.revenue_prev_7d || 0);\nconst curr = parseFloat(m.revenue_7d || 0);\nconst wowPct = prev > 0 ? Math.round((curr - prev) / prev * 100) : null;\nconst wowStr = wowPct !== null ? (wowPct >= 0 ? '+' : '') + wowPct + '%' : 'N/A';\n\nconst euPct = parseFloat(m.current_eu_content_pct || 0);\nconst avmsdFlag = euPct < 30 ? '\u26a0\ufe0f BELOW 30% AVMSD THRESHOLD' : '\u2705 AVMSD COMPLIANT';\n\nconst html = `<h2>MediaTech Platform \u2014 Weekly KPI Report</h2>\n<table border='1' cellpadding='6' style='border-collapse:collapse'>\n<tr><th>Metric</th><th>This Week</th><th>WoW</th></tr>\n<tr><td>DAU (7d)</td><td>${m.dau_7d}</td><td>\u2014</td></tr>\n<tr><td>MAU (30d)</td><td>${m.mau_30d}</td><td>\u2014</td></tr>\n<tr><td>Watch Hours (7d)</td><td>${Math.round(m.total_watch_hours_7d||0).toLocaleString()}</td><td>\u2014</td></tr>\n<tr><td>Active Creators</td><td>${m.active_creators_7d}</td><td>\u2014</td></tr>\n<tr><td>Revenue (7d)</td><td>$${parseFloat(curr).toFixed(0)}</td><td>${wowStr}</td></tr>\n<tr><td>DSA Art.14 Notices</td><td>${m.dsa_notices_7d||0}</td><td>\u2014</td></tr>\n<tr><td>DMCA \u00a7512 Notices</td><td>${m.dmca_notices_7d||0}</td><td>\u2014</td></tr>\n<tr><td>Art.17 Upload Matches</td><td>${m.art17_matches_7d||0}</td><td>\u2014</td></tr>\n<tr><td>COPPA Flags</td><td>${m.coppa_flags_7d||0}</td><td>\u2014</td></tr>\n<tr><td>EU Content % (AVMSD)</td><td>${euPct}%</td><td>${avmsdFlag}</td></tr>\n</table>`;\n\nreturn [{ json: { html, wowPct, avmsdFlag, eu_pct: euPct } }];"
      }
    },
    {
      "id": "6",
      "name": "Gmail CEO + BCC Legal",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        800,
        0
      ],
      "parameters": {
        "operation": "send",
        "sendTo": "={{ $vars.CEO_EMAIL }}",
        "subject": "Weekly MediaTech Platform KPI \u2014 {{ new Date().toISOString().split('T')[0] }}",
        "message": "={{ $json.html }}",
        "additionalFields": {
          "isHtml": true,
          "bccList": "={{ $vars.LEGAL_EMAIL }}"
        }
      }
    }
  ],
  "connections": {
    "Monday 8AM": {
      "main": [
        [
          {
            "node": "Fetch Platform Metrics",
            "type": "main",
            "index": 0
          },
          {
            "node": "Fetch Compliance Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Platform Metrics": {
      "main": [
        [
          {
            "node": "Merge Metrics",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Compliance Events": {
      "main": [
        [
          {
            "node": "Merge Metrics",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge Metrics": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Report": {
      "main": [
        [
          {
            "node": "Gmail CEO + BCC Legal",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Why self-hosted n8n, not Zapier or Make?

Concern	Zapier/Make	Self-hosted n8n
User-generated content PII	Routes through US cloud	Stays in your VPC
DMCA takedown audit trail	Vendor controls logs	Your Postgres, your retention
Art.17 rights-holder data	Third-party processor	You control processor chain
COPPA child PII	Data egress risk	Zero egress, on-prem
DSA Art.14 24h SLA	Zapier outage = missed deadline	On-prem uptime = your SLA
GDPR Art.28 DPA	Vendor DPA + sub-processors	Single DPA, no sub-processor chain

Get the complete workflow bundle

These five workflows are part of the FlowKit n8n Automation Template Bundle — 14 production-ready workflows for $97.

→ stripeai.gumroad.com

Individual templates start at $12. The bundle includes MediaTech compliance, SaaS ops, email automation, CRM, reporting, and more.

Workflow JSON is import-ready. Replace $vars.PAYMENT_PAGE_URL, $vars.CONTENT_ID_API_URL, and other env variables with your actual values. All workflows self-host on n8n Community Edition.

n8n for RetailTech & eCommerce SaaS: 5 Automations for PCI DSS v4.0, ADA Title III, and EU Consumer Rights Compliance (Free Workflow JSON)

Alex Kane — Thu, 28 May 2026 22:47:06 +0000

If you run a RetailTech or eCommerce SaaS platform, you're operating at the intersection of the most aggressive new enforcement cycles in digital commerce.

PCI DSS v4.0 went into full enforcement March 31, 2025 — Requirement 6.4.3 mandates a live inventory of every JavaScript on your payment page with an authorization justification, and Requirement 11.6.1 mandates a tamper-detection mechanism that alerts within 6 hours of any unauthorized change. Most eCommerce SaaS vendors have dozens of third-party payment page scripts and no automated inventory.

ADA Title III website accessibility litigation hit 4,605 cases in 2023 (Robles v. Domino's 9th Cir. 2019 established the standard). WCAG 2.1 AA is the benchmark. Settlement exposure: $20K–$55K per case before legal fees.

EU Consumer Rights Directive gives buyers a 14-day no-fault withdrawal right on digital purchases (Article 9). GDPR Art. 17 requires erasure within 30 days of request. EU DSA Art. 26 mandates recommender system transparency for marketplaces. EU DMA Art. 5 bans self-preferencing for gatekeepers. FTC Green Guides (16 CFR Part 260) prohibit vague environmental claims — a real enforcement risk for any brand using recycled/sustainable messaging.

Self-hosted n8n handles all of these in five workflows. No payment card data or PII leaves your infrastructure.

Who this is for

Tier	Example	Primary pain
ENTERPRISE_ECOMMERCE_SAAS	Salesforce Commerce Cloud, SAP Commerce	PCI DSS v4.0 scope + DSA/DMA
MID_MARKET_ECOMMERCE	BigCommerce, Netsuite SuiteCommerce	ADA Title III + PCI v4.0 Req 6.4.3
MARKETPLACE_SAAS	Multi-vendor marketplace platforms	EU DSA Art. 26 + Art. 17 erasure
HEADLESS_COMMERCE_SAAS	Composable/headless storefronts	PCI Req 11.6.1 tamper detection
SUBSCRIPTION_COMMERCE_SAAS	Subscription billing platforms	Consumer Rights Directive 14-day window
CROSS_BORDER_ECOMMERCE_SAAS	Cross-border platforms	EU DMA + Consumer Rights + GDPR erasure
ECOMMERCE_STARTUP	New eCommerce SaaS entrants	ADA + FTC Green Guides + CCPA opt-out

Workflow 1 — PCI DSS v4.0 Payment Page Script Inventory & Tamper-Detection Monitor

Regulations: PCI DSS v4.0 Req 6.4.3 (authorized script inventory) + Req 11.6.1 (tamper-detection within 6 hours)

Why it matters: Every JavaScript tag on your checkout page must be inventoried, authorized, and monitored. Unauthorized script injection (Magecart, formjacking) must trigger an alert within 6 hours. Manual audits fail on dynamic tag-manager environments.

{
  "name": "PCI DSS v4.0 Payment Page Script Inventory & Tamper-Detection Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Run Every Hour",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "minutesInterval": 1
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Fetch Payment Page HTML",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        200,
        0
      ],
      "parameters": {
        "url": "={{ $vars.PAYMENT_PAGE_URL }}",
        "method": "GET",
        "options": {
          "response": {
            "response": {
              "responseFormat": "text"
            }
          }
        }
      }
    },
    {
      "id": "3",
      "name": "Extract & Inventory Scripts",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const html = $input.first().json.data;\nconst scriptRegex = /<script[^>]*src=[\"']([^\"']+)[\"'][^>]*>/gi;\nconst scripts = [];\nlet match;\nwhile ((match = scriptRegex.exec(html)) !== null) {\n  scripts.push(match[1]);\n}\n\nconst authorizedInventory = JSON.parse($vars.PCI_AUTHORIZED_SCRIPTS || '[]');\nconst found = scripts;\nconst unauthorized = found.filter(s => !authorizedInventory.includes(s));\nconst missing = authorizedInventory.filter(s => !found.includes(s));\n\nconst now = new Date().toISOString();\nconst fingerprint = require('crypto').createHash('sha256').update(found.sort().join(',')).digest('hex');\nconst lastFingerprint = $getWorkflowStaticData('global').lastFingerprint || '';\n\nlet changed = fingerprint !== lastFingerprint;\n$getWorkflowStaticData('global').lastFingerprint = fingerprint;\n$getWorkflowStaticData('global').lastCheck = now;\n\nreturn [{\n  json: {\n    checked_at: now,\n    total_scripts: found.length,\n    unauthorized_scripts: unauthorized,\n    missing_authorized: missing,\n    fingerprint_changed: changed,\n    fingerprint,\n    req_6_4_3_breach: unauthorized.length > 0,\n    req_11_6_1_breach: changed && unauthorized.length > 0\n  }\n}];"
      }
    },
    {
      "id": "4",
      "name": "PCI Breach Check",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "leftValue": "={{ $json.req_11_6_1_breach || $json.req_6_4_3_breach }}",
            "operation": "equal",
            "rightValue": true
          }
        },
        "combineOperation": "any"
      }
    },
    {
      "id": "5",
      "name": "Slack PCI Critical Alert",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        800,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#pci-compliance-alerts",
        "text": "\ud83d\udea8 PCI DSS v4.0 BREACH \u2014 {{ $json.req_11_6_1_breach ? 'Req 11.6.1 TAMPER DETECTED' : 'Req 6.4.3 UNAUTHORIZED SCRIPT' }}\\nTime: {{ $json.checked_at }}\\nUnauthorized scripts: {{ $json.unauthorized_scripts.join(', ') || 'none' }}\\nFingerprint changed: {{ $json.fingerprint_changed }}\\nSLA: Alert must reach QSA within 6 hours (Req 11.6.1)\\nAction: Freeze deploy pipeline + engage QSA immediately"
      }
    },
    {
      "id": "6",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        800,
        100
      ],
      "parameters": {
        "operation": "insert",
        "schema": "public",
        "table": "pci_script_audit_log",
        "dataMode": "autoMapInputData"
      }
    }
  ],
  "connections": {
    "Run Every Hour": {
      "main": [
        [
          "Fetch Payment Page HTML"
        ]
      ]
    },
    "Fetch Payment Page HTML": {
      "main": [
        [
          "Extract & Inventory Scripts"
        ]
      ]
    },
    "Extract & Inventory Scripts": {
      "main": [
        [
          "PCI Breach Check"
        ]
      ]
    },
    "PCI Breach Check": {
      "main": [
        [
          "Slack PCI Critical Alert"
        ],
        [
          "Log to Postgres"
        ]
      ]
    }
  }
}

Workflow 2 — ADA Title III / WCAG 2.1 AA Accessibility Compliance Deadline Tracker

Regulations: ADA Title III (Robles v. Domino's 9th Cir. 2019), WCAG 2.1 AA, EU Web Accessibility Directive 2016/2102

Why it matters: 4,605 ADA website lawsuits filed in 2023 alone. Most target eCommerce sites — missing alt text, inaccessible checkout flows, missing keyboard navigation. Settlement exposure $20K–$55K before legal fees.

{
  "name": "ADA Title III / WCAG 2.1 AA Accessibility Deadline & Audit Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Load ADA Audit Schedule",
      "type": "n8n-nodes-base.googleSheets",
      "typeVersion": 4.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "getAll",
        "documentId": "={{ $vars.ADA_AUDIT_SHEET_ID }}",
        "sheetName": "accessibility_audits",
        "options": {
          "headerRow": 1
        }
      }
    },
    {
      "id": "3",
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const now = new Date();\nconst results = [];\nfor (const row of $input.all()) {\n  const d = row.json;\n  const auditDate = new Date(d.next_audit_date);\n  const daysUntil = Math.floor((auditDate - now) / 86400000);\n  let urgency, action;\n  if (daysUntil < 0) { urgency = 'OVERDUE'; action = 'IMMEDIATE \u2014 engage accessibility consultant'; }\n  else if (daysUntil <= 7) { urgency = 'CRITICAL'; action = 'Audit this week \u2014 Robles v Dominos exposure'; }\n  else if (daysUntil <= 21) { urgency = 'URGENT'; action = 'Schedule WCAG 2.1 AA audit'; }\n  else if (daysUntil <= 45) { urgency = 'WARNING'; action = 'Prepare audit scope and axe/WAVE tooling'; }\n  else { urgency = 'NOTICE'; action = 'Monitor'; }\n  if (['OVERDUE','CRITICAL','URGENT','WARNING'].includes(urgency)) {\n    results.push({ json: { ...d, urgency, daysUntil, action, checked_at: now.toISOString() }});\n  }\n}\nreturn results.length ? results : [{ json: { urgency: 'ALL_CLEAR', count: $input.all().length } }];"
      }
    },
    {
      "id": "4",
      "name": "Slack ADA Alert",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        600,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#legal-compliance",
        "text": "\u2696\ufe0f ADA Title III \u2014 {{ $json.urgency }}: {{ $json.component }} due {{ $json.next_audit_date }} ({{ $json.daysUntil }}d)\\nAction: {{ $json.action }}\\nScope: WCAG 2.1 AA \u2014 checkout, search, PDPs, cart"
      }
    },
    {
      "id": "5",
      "name": "Email Compliance Officer",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        600,
        100
      ],
      "parameters": {
        "operation": "send",
        "toList": "={{ $vars.COMPLIANCE_EMAIL }}",
        "subject": "ADA Title III {{ $json.urgency }}: {{ $json.component }} \u2014 {{ $json.daysUntil }} days",
        "message": "ADA audit {{ $json.urgency }} for {{ $json.component }}. Due: {{ $json.next_audit_date }}. Action: {{ $json.action }}. Robles v. Domino's 9th Cir. 2019 \u2014 website accessibility = ADA Title III public accommodation."
      }
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          "Load ADA Audit Schedule"
        ]
      ]
    },
    "Load ADA Audit Schedule": {
      "main": [
        [
          "Classify Urgency"
        ]
      ]
    },
    "Classify Urgency": {
      "main": [
        [
          "Slack ADA Alert",
          "Email Compliance Officer"
        ]
      ]
    }
  }
}

Workflow 3 — EU Consumer Rights Directive 14-Day Withdrawal & GDPR Art. 17 Erasure Clock

Regulations: EU Consumer Rights Directive 2011/83/EU Art. 9 (14-day withdrawal), GDPR Art. 17 (erasure within 30 days of request), CCPA/CPRA right to delete

Why it matters: For cross-border eCommerce platforms, a missed 14-day withdrawal window triggers Art. 14 automatic extension to 12 months. A missed GDPR Art. 17 erasure request triggers €20M or 4% global turnover fine. Subscription platforms face the highest volume.

{
  "name": "EU Consumer Rights 14-Day Withdrawal + GDPR Art.17 Erasure Clock",
  "nodes": [
    {
      "id": "1",
      "name": "Every 6 Hours",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "minutesInterval": 6
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Load Open Requests",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT *, EXTRACT(EPOCH FROM (NOW() - created_at))/3600 AS hours_elapsed FROM consumer_rights_requests WHERE status = 'OPEN' AND (request_type IN ('EU_WITHDRAWAL', 'GDPR_ERASURE', 'CCPA_DELETE'));"
      }
    },
    {
      "id": "3",
      "name": "Classify SLA Breach",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const slaDefs = {\n  EU_WITHDRAWAL: { slaHours: 14*24, reg: 'EU CRD Art.9', penalty: '12-month auto-extension window' },\n  GDPR_ERASURE: { slaHours: 30*24, reg: 'GDPR Art.17', penalty: '\u20ac20M or 4% global revenue' },\n  CCPA_DELETE: { slaHours: 45*24, reg: 'CCPA/CPRA', penalty: '$100\u2013$750 per consumer per incident' }\n};\nconst alerts = [];\nfor (const item of $input.all()) {\n  const d = item.json;\n  const sla = slaDefs[d.request_type];\n  if (!sla) continue;\n  const pct = d.hours_elapsed / sla.slaHours * 100;\n  let urgency;\n  if (pct >= 100) urgency = 'OVERDUE';\n  else if (pct >= 90) urgency = 'CRITICAL';\n  else if (pct >= 75) urgency = 'URGENT';\n  else if (pct >= 50) urgency = 'WARNING';\n  else continue;\n  alerts.push({ json: { ...d, urgency, pct_elapsed: Math.round(pct), ...sla } });\n}\nreturn alerts.length ? alerts : [{ json: { urgency: 'ALL_CLEAR' } }];"
      }
    },
    {
      "id": "4",
      "name": "Alert Compliance + DPO",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "operation": "send",
        "toList": "={{ $vars.DPO_EMAIL }}",
        "subject": "{{ $json.reg }} {{ $json.urgency }}: Request #{{ $json.request_id }} \u2014 {{ $json.pct_elapsed }}% of SLA elapsed",
        "message": "Consumer rights request SLA breach alert.\\nRequest: #{{ $json.request_id }} / Type: {{ $json.request_type }}\\nCustomer: {{ $json.customer_email }}\\nRegulation: {{ $json.reg }}\\nElapsed: {{ $json.pct_elapsed }}% of SLA ({{ $json.hours_elapsed }}h)\\nPenalty exposure: {{ $json.penalty }}\\nAction: Process immediately and log completion timestamp for audit trail."
      }
    }
  ],
  "connections": {
    "Every 6 Hours": {
      "main": [
        [
          "Load Open Requests"
        ]
      ]
    },
    "Load Open Requests": {
      "main": [
        [
          "Classify SLA Breach"
        ]
      ]
    },
    "Classify SLA Breach": {
      "main": [
        [
          "Alert Compliance + DPO"
        ]
      ]
    }
  }
}

Workflow 4 — FTC Green Guides Claims Monitor + Consumer Review Fairness Act Alert Pipeline

Regulations: FTC Green Guides 16 CFR Part 260 (environmental claims), Consumer Review Fairness Act 15 USC §45b (review suppression), EU Eco-label Regulation, EU DSA Art. 26 (recommender system transparency)

Why it matters: FTC issued 20+ Green Guides enforcement actions in 2022–2024. Platforms hosting seller listings with unqualified 'eco', 'sustainable', 'carbon neutral', or 'green' claims face secondary liability. Consumer Review Fairness Act prohibits clauses that prevent customers from posting honest reviews — a hidden ToS clause creates federal exposure.

{
  "name": "FTC Green Guides Claims Monitor + Consumer Review Fairness Act Alert",
  "nodes": [
    {
      "id": "1",
      "name": "Daily 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * *"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Load New Product Listings",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT id, seller_id, product_title, product_description, tags FROM product_listings WHERE created_at > NOW() - INTERVAL '24 hours' AND green_claims_reviewed = false;"
      }
    },
    {
      "id": "3",
      "name": "Scan for Risky Claims",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const riskyTerms = [\n  {term: 'eco-friendly', risk: 'UNQUALIFIED_ECO_CLAIM', reg: 'FTC Green Guides 16 CFR \u00a7260.7'},\n  {term: 'sustainable', risk: 'VAGUE_SUSTAINABILITY', reg: 'FTC Green Guides \u00a7260.1'},\n  {term: 'carbon neutral', risk: 'UNVERIFIED_CARBON_CLAIM', reg: 'FTC Green Guides \u00a7260.4'},\n  {term: 'biodegradable', risk: 'UNQUALIFIED_BIODEGRADABLE', reg: 'FTC Green Guides \u00a7260.8'},\n  {term: 'green', risk: 'VAGUE_GREEN_CLAIM', reg: 'FTC Green Guides \u00a7260.1'},\n  {term: 'recycled', risk: 'RECYCLED_CONTENT_UNVERIFIED', reg: 'FTC Green Guides \u00a7260.12'},\n  {term: 'no negative reviews', risk: 'REVIEW_SUPPRESSION', reg: '15 USC \u00a745b Consumer Review Fairness Act'},\n  {term: 'prohibit reviews', risk: 'REVIEW_PROHIBITION', reg: '15 USC \u00a745b Consumer Review Fairness Act'}\n];\nconst findings = [];\nfor (const item of $input.all()) {\n  const d = item.json;\n  const text = ((d.product_title||'') + ' ' + (d.product_description||'')).toLowerCase();\n  const hits = riskyTerms.filter(t => text.includes(t.term));\n  if (hits.length > 0) {\n    findings.push({ json: { ...d, risk_terms: hits.map(h => h.term), risk_types: hits.map(h => h.risk), regulations: hits.map(h => h.reg), highest_risk: hits.some(h => h.risk.includes('REVIEW')) ? 'REVIEW_SUPPRESSION' : 'GREEN_CLAIMS' } });\n  }\n}\nreturn findings.length ? findings : [{ json: { status: 'NO_RISKY_CLAIMS', checked: $input.all().length } }];"
      }
    },
    {
      "id": "4",
      "name": "Route by Risk Type",
      "type": "n8n-nodes-base.switch",
      "typeVersion": 3.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "dataType": "string",
        "value1": "={{ $json.highest_risk }}",
        "rules": {
          "rules": [
            {
              "value2": "REVIEW_SUPPRESSION",
              "outputIndex": 0
            },
            {
              "value2": "GREEN_CLAIMS",
              "outputIndex": 1
            }
          ]
        }
      }
    },
    {
      "id": "5",
      "name": "Legal Alert - Review Suppression",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        800,
        -100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#legal-urgent",
        "text": "\u26a0\ufe0f Consumer Review Fairness Act (15 USC \u00a745b) flag\\nProduct: {{ $json.product_title }} (ID: {{ $json.id }})\\nSeller: {{ $json.seller_id }}\\nRisk: Review suppression clause detected\\nAction: Legal review + seller notification required within 24h\\nFTC can pursue unfair/deceptive practice action"
      }
    },
    {
      "id": "6",
      "name": "Trust & Safety Alert - Green Claims",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.1,
      "position": [
        800,
        100
      ],
      "parameters": {
        "authentication": "accessToken",
        "resource": "message",
        "operation": "post",
        "channel": "#trust-safety",
        "text": "\ud83c\udf3f FTC Green Guides flag\\nProduct: {{ $json.product_title }}\\nTerms: {{ $json.risk_terms.join(', ') }}\\nRegulations: {{ $json.regulations.join(' | ') }}\\nAction: Require seller substantiation or add qualification language"
      }
    }
  ],
  "connections": {
    "Daily 7AM": {
      "main": [
        [
          "Load New Product Listings"
        ]
      ]
    },
    "Load New Product Listings": {
      "main": [
        [
          "Scan for Risky Claims"
        ]
      ]
    },
    "Scan for Risky Claims": {
      "main": [
        [
          "Route by Risk Type"
        ]
      ]
    },
    "Route by Risk Type": {
      "main": [
        [
          "Legal Alert - Review Suppression"
        ],
        [
          "Trust & Safety Alert - Green Claims"
        ]
      ]
    }
  }
}

Workflow 5 — Weekly eCommerce Platform KPI Dashboard (PCI / ADA / DSA Compliance Health)

Who receives it: CEO, CPO, Head of Engineering, BCC: Chief Compliance Officer

{
  "name": "Weekly eCommerce Platform KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      }
    },
    {
      "id": "2",
      "name": "Load Platform Metrics",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        200,
        0
      ],
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT\\n  COUNT(DISTINCT merchant_id) AS active_merchants,\\n  COUNT(DISTINCT CASE WHEN created_at > NOW()-INTERVAL '7d' THEN merchant_id END) AS new_merchants_7d,\\n  SUM(gmv_7d) AS gmv_7d,\\n  SUM(gmv_prior_7d) AS gmv_prior_7d,\\n  COUNT(CASE WHEN pci_scripts_clean = true THEN 1 END) AS merchants_pci_clean,\\n  COUNT(CASE WHEN ada_audit_overdue = true THEN 1 END) AS ada_overdue_count,\\n  COUNT(CASE WHEN open_gdpr_requests > 0 THEN 1 END) AS gdpr_open_requests,\\n  COUNT(CASE WHEN green_claims_flags > 0 THEN 1 END) AS green_claims_flagged\\nFROM merchant_compliance_summary WHERE snapshot_date = CURRENT_DATE - 1;"
      }
    },
    {
      "id": "3",
      "name": "Build HTML Report",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        400,
        0
      ],
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst gmvWoW = d.gmv_prior_7d > 0 ? ((d.gmv_7d - d.gmv_prior_7d)/d.gmv_prior_7d*100).toFixed(1) : 'N/A';\nconst gmvFlag = parseFloat(gmvWoW) < -10 ? '\ud83d\udd34' : parseFloat(gmvWoW) < -5 ? '\ud83d\udfe1' : '\ud83d\udfe2';\nconst pciCoverage = d.active_merchants > 0 ? (d.merchants_pci_clean/d.active_merchants*100).toFixed(0) : 0;\nconst html = `<h2>eCommerce Platform Weekly Report \u2014 ${new Date().toISOString().split('T')[0]}</h2>\n<h3>Business Metrics</h3>\n<table border=1 cellpadding=5>\n<tr><th>Metric</th><th>Value</th><th>WoW</th></tr>\n<tr><td>Active Merchants</td><td>${d.active_merchants}</td><td>New this week: ${d.new_merchants_7d}</td></tr>\n<tr><td>GMV (7d)</td><td>$${Number(d.gmv_7d).toLocaleString()}</td><td>${gmvFlag} ${gmvWoW}%</td></tr>\n</table>\n<h3>Compliance Health</h3>\n<table border=1 cellpadding=5>\n<tr><th>Check</th><th>Status</th><th>Regulation</th></tr>\n<tr><td>PCI DSS v4.0 Script Clean</td><td>${pciCoverage}% of merchants</td><td>Req 6.4.3 + 11.6.1</td></tr>\n<tr><td>ADA Title III Overdue</td><td style='color:${d.ada_overdue_count>0?\"red\":\"green\"}'>${d.ada_overdue_count} merchants</td><td>WCAG 2.1 AA</td></tr>\n<tr><td>Open GDPR Erasure Requests</td><td style='color:${d.gdpr_open_requests>0?\"orange\":\"green\"}'>${d.gdpr_open_requests}</td><td>GDPR Art. 17 (30d SLA)</td></tr>\n<tr><td>Green Claims Flagged</td><td style='color:${d.green_claims_flagged>0?\"orange\":\"green\"}'>${d.green_claims_flagged}</td><td>FTC Green Guides 16 CFR \u00a7260</td></tr>\n</table>`;\nreturn [{ json: { html, subject: `eCommerce Platform Weekly Report \u2014 GMV ${gmvFlag} ${gmvWoW}% WoW` } }];"
      }
    },
    {
      "id": "4",
      "name": "Email Leadership",
      "type": "n8n-nodes-base.gmail",
      "typeVersion": 2.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "operation": "send",
        "toList": "={{ $vars.CEO_EMAIL }}",
        "ccList": "={{ $vars.CPO_EMAIL }},{{ $vars.ENG_HEAD_EMAIL }}",
        "bccList": "={{ $vars.COMPLIANCE_EMAIL }}",
        "subject": "={{ $json.subject }}",
        "message": "={{ $json.html }}",
        "options": {
          "appendAttribution": false
        }
      }
    }
  ],
  "connections": {
    "Monday 8AM": {
      "main": [
        [
          "Load Platform Metrics"
        ]
      ]
    },
    "Load Platform Metrics": {
      "main": [
        [
          "Build HTML Report"
        ]
      ]
    },
    "Build HTML Report": {
      "main": [
        [
          "Email Leadership"
        ]
      ]
    }
  }
}

Why self-host n8n for eCommerce SaaS compliance

Risk	If using Zapier / Make	Self-hosted n8n
PCI DSS v4.0 Req 6.4.3	Payment page script monitoring flows through third-party cloud — QSA scope expansion	Runs inside your VPC — no external processor in PCI scope
GDPR Art. 17 erasure	Customer PII processed by sub-processor without explicit GDPR Art. 28 DPA	All erasure logic stays in your perimeter, Postgres audit trail
ADA Title III	Accessibility audit scheduling data egresses — potential litigation hold violation	Evidence chain stays in-house
SOC 2 CC9.2	iPaaS = additional vendor risk finding	n8n self-hosted = no third-party vendor risk in workflow layer
EU DSA Art. 26	Recommender system data flows through US cloud processor	Data stays in EU infrastructure

Get the templates

All five workflows are available as ready-to-import JSON files at stripeai.gumroad.com.

The complete bundle (15+ templates for SaaS teams) is at stripeai.gumroad.com.

Questions or want a specific vertical covered next? Drop a comment below.

n8n for LogisticsTech/Supply Chain SaaS: 5 Automations for CBP Advance Manifest, FMCSA ELD, FDA FSMA, and EU CSDDD [Free JSON]

Alex Kane — Thu, 28 May 2026 22:32:59 +0000

If your logistics or supply chain SaaS platform helps 3PLs, freight brokers, TMS vendors, or cold-chain operators manage compliance, your customers are juggling a stack of interlocking regulatory clocks that have nothing to do with each other but all run simultaneously.

A single international shipment can trigger: CBP's 24-hour advance manifest clock (Trade Act 2002), an FMC detention dispute window (Ocean Shipping Reform Act 2022), FMCSA ELD hours-of-service limits (49 CFR Part 395), FDA FSMA supplier verification requirements (21 CFR Part 117), EU CSDDD supply chain due diligence obligations (Directive 2024/1760), and SEC Scope 3 emissions reporting (for larger platforms). Each regulation has different enforcement agencies, different penalty structures, and different deadlines.

Here are five n8n workflows that address the highest-penalty clocks in this stack. Full JSON below.

Why LogisticsTech SaaS vendors face unusual compliance exposure

Most SaaS compliance automation articles focus on data privacy or financial regulations. Logistics compliance is different because the penalties are physical — a Do Not Load (DNL) order stops a vessel from departing, out-of-service (OOS) orders ground trucks, and a FSMA recall can empty shelves.

CBP Trade Act 2002: The 24-hour advance manifest rule requires cargo details filed with CBP at least 24 hours before vessel loading in a foreign port. Miss the window and CBP issues a Do Not Load order. Penalty: $5,000 per shipment. For a 3PL processing 50 shipments/day, a systemic failure can generate $250,000 in penalties before the compliance team notices.

FMC Ocean Shipping Reform Act 2022: Before OSRA 2022, ocean carriers routinely billed detention and demurrage even when containers weren't actually available for pickup. OSRA 2022 made these practices prohibited. If your freight broker or TMS SaaS is processing carrier detention invoices, the platform needs to flag invoices where container availability wasn't confirmed — otherwise your customers are paying illegal charges.

FMCSA ELD HOS: The Electronic Logging Device mandate (49 CFR Part 395) requires electronic logging of all hours-of-service data for commercial motor vehicles. The 11-hour driving limit, 14-hour on-duty window, and 30-minute break requirement each carry out-of-service penalties of $1,000–$16,000 per violation. A TMS or 3PL SaaS that monitors driver data has a real-time compliance window — but only if the monitoring is fast enough to catch violations before the driver is already OOS.

FDA FSMA 21 CFR Part 117: The Food Safety Modernization Act requires food-grade shippers and cold-chain operators to maintain PCQI (Preventive Controls Qualified Individual) oversight, supplier verification programs, and full lot traceability. The FDA Traceability Rule (21 CFR §1.1310) — effective January 2026 — requires end-to-end lot tracking for high-risk foods. A cold-chain SaaS platform that doesn't surface these supplier verification gaps is leaving customers exposed to warning letters, consent decrees, and potential criminal referrals.

EU CSDDD Directive 2024/1760: The Corporate Sustainability Due Diligence Directive requires companies above revenue/employee thresholds to conduct annual human rights and environmental due diligence across their entire supply chain — and document it. Penalty: up to €5M or 5% of global annual turnover. For logistics SaaS platforms serving EU-headquartered 3PLs and freight operators, this is a 2025–2026 implementation urgency.

SEC Scope 3 / California SB 253: Large accelerated filers face mandatory Scope 3 supply chain emissions reporting under SEC's Climate Disclosure Rule (FY2026 for LAFs). California SB 253 applies to companies with >$1B California revenue. TMS and supply chain platforms that can surface emissions data from carrier routing are positioned to be critical infrastructure for Scope 3 compliance.

The self-hosting argument for logistics SaaS

FMCSA ELD data is particularly sensitive: it contains real-time driver location, driving behavior, and hours-of-service records. Under 49 CFR §395.8, this data must be available to authorized safety officials on demand. If your TMS or 3PL SaaS routes ELD data through Zapier or Make, those automation vendor servers are in the ELD data chain — which complicates the FMCSA audit scope. Self-hosted n8n keeps the ELD data inside your platform's perimeter, which simplifies the compliance boundary considerably.

For cold-chain operators under FSMA, lot traceability records need to be producible within 24 hours of an FDA request (21 CFR §1.1315). If your traceability automation pipeline routes through a third-party iPaaS, that vendor's retention policy — not yours — governs how long those records are available.

EU CSDDD Art.21 supply chain assessment guidance from ENISA and the European Commission includes iPaaS vendors processing supply chain data as in-scope third parties. A 3PL SaaS using Zapier to orchestrate CSDDD supplier audits is adding a third-party vendor to the CSDDD scope definition.

The 5 workflows

1. CBP Advance Manifest & FMC Detention Compliance Pipeline

Webhook-triggered on every shipment event. Evaluates: (1) CBP 24-hour manifest deadline — calculates hours remaining, flags Do Not Load risk with $5,000 penalty annotation. (2) FMC OSRA 2022 — checks whether detention invoices arrived without confirmed container availability (FMC prohibited practice). (3) C-TPAT status for green-lane routing. Tier-segmented flag arrays: 3PL gets CBP+FMC+CTPAT+FMCSA_ELD, Customs Broker gets CBP+5106+CTPAT+OFAC_SCREENING+ACE_FILING.

{
  "name": "CBP Advance Manifest & FMC Detention Compliance Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "Shipment Event Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "shipment-event",
        "responseMode": "responseNode"
      },
      "position": [
        250,
        300
      ]
    },
    {
      "id": "2",
      "name": "CBP/FMC Compliance Check",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "\n// CBP Trade Act 2002 24h advance manifest + FMC Ocean Shipping Reform Act 2022\nconst ship = $json;\nconst now = new Date();\n\n// CBP: manifest must be filed 24h before vessel departure\n// Penalty: Do Not Load (DNL) order + $5,000/shipment\nconst departureTs = new Date(ship.vessel_departure_utc);\nconst manifestDeadlineTs = new Date(departureTs.getTime() - 24*60*60*1000);\nconst hoursToManifestDeadline = (manifestDeadlineTs - now) / (60*60*1000);\n\n// FMC Ocean Shipping Reform Act 2022: demurrage/detention prohibitions\n// Carrier cannot invoice detention if container not available for pickup\n// Shipper must prove container availability before detention clock starts\nconst fmcFlags = [];\nif (ship.detention_billed && !ship.container_available_confirmed) {\n  fmcFlags.push({\n    type: 'FMC_PROHIBITED_DETENTION',\n    severity: 'CRITICAL',\n    regulation: 'FMC Ocean Shipping Reform Act 2022 \u00a741102(d)',\n    action: 'File FMC complaint \u2014 detention invoice without container availability confirmation is prohibited practice',\n    deadline: '30 days from invoice receipt to dispute'\n  });\n}\nif (ship.demurrage_billed && !ship.earliest_return_date_provided) {\n  fmcFlags.push({\n    type: 'FMC_PROHIBITED_DEMURRAGE',\n    severity: 'CRITICAL',\n    regulation: 'FMC 46 CFR Part 545 \u2014 Demurrage/Detention Billing Practices',\n    action: 'Reject invoice \u2014 carrier must provide Earliest Return Date (ERD) before demurrage accrues',\n    deadline: 'Immediate dispute required'\n  });\n}\n\n// CTPAT/C-TPAT AMS ACE filing\nconst ctpatStatus = ship.ctpat_partner ? 'CTPAT_GREEN_LANE' : 'STANDARD_EXAM_RISK';\n\n// Tier segmentation\nconst TIER_FLAGS = {\n  '3PL_SAAS': ['CBP_MANIFEST', 'FMC_DETENTION', 'CTPAT', 'FMCSA_ELD', 'FSMA_CARRIER'],\n  'FREIGHT_BROKER_SAAS': ['CBP_MANIFEST', 'FMC_DETENTION', 'FMCSA_BROKER_AUTHORITY', 'CTPAT'],\n  'TMS_SAAS': ['CBP_MANIFEST', 'FMCSA_ELD', 'FMC_DETENTION', 'FSMA', 'CSDDD_SCOPE3'],\n  'COLD_CHAIN_SAAS': ['FSMA_PCQI', 'FDA_SANITARY_TRANSPORT', 'FMCSA_ELD', 'FSMA_TEMP_LOG'],\n  'CUSTOMS_BROKER_SAAS': ['CBP_MANIFEST', 'CBP_5106', 'CTPAT', 'OFAC_SCREENING', 'ACE_FILING'],\n  'LAST_MILE_DELIVERY_SAAS': ['FMCSA_ELD', 'DOT_SAFETY', 'CCPA_DRIVER_DATA', 'FMCSA_HOS'],\n  'LOGISTICS_STARTUP': ['CBP_MANIFEST', 'FMCSA_ELD', 'FSMA', 'FMC_DETENTION']\n};\nconst tier = ship.tier || 'LOGISTICS_STARTUP';\nconst tierFlags = TIER_FLAGS[tier] || TIER_FLAGS['LOGISTICS_STARTUP'];\n\n// CBP manifest urgency\nlet cbpUrgency = 'NORMAL';\nlet cbpAlert = false;\nif (!ship.manifest_filed) {\n  if (hoursToManifestDeadline <= 0) {\n    cbpUrgency = 'DO_NOT_LOAD_RISK';\n    cbpAlert = true;\n  } else if (hoursToManifestDeadline <= 4) {\n    cbpUrgency = 'CRITICAL';\n    cbpAlert = true;\n  } else if (hoursToManifestDeadline <= 12) {\n    cbpUrgency = 'URGENT';\n    cbpAlert = true;\n  }\n}\n\nreturn [{\n  json: {\n    shipment_id: ship.shipment_id,\n    tier,\n    tier_flags: tierFlags,\n    cbp: {\n      manifest_filed: ship.manifest_filed || false,\n      hours_to_deadline: Math.round(hoursToManifestDeadline * 10) / 10,\n      deadline_utc: manifestDeadlineTs.toISOString(),\n      urgency: cbpUrgency,\n      alert_required: cbpAlert,\n      penalty_risk: cbpUrgency === 'DO_NOT_LOAD_RISK' ? '$5,000/shipment + Do Not Load order \u2014 CBP Trade Act 2002' : null\n    },\n    fmc_flags: fmcFlags,\n    ctpat_status: ctpatStatus,\n    alert_required: cbpAlert || fmcFlags.length > 0\n  }\n}];\n"
      },
      "position": [
        450,
        300
      ]
    },
    {
      "id": "3",
      "name": "Alert Required?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.alert_required }}",
              "value2": true,
              "operation": "equal"
            }
          ]
        }
      },
      "position": [
        650,
        300
      ]
    },
    {
      "id": "4",
      "name": "Slack #customs-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#customs-compliance",
        "text": "={{ $json.cbp.urgency === 'DO_NOT_LOAD_RISK' ? '\ud83d\udea8 CBP DO NOT LOAD RISK' : '\u26a0\ufe0f CBP Manifest Alert' }} | Shipment {{ $json.shipment_id }} | Hours to deadline: {{ $json.cbp.hours_to_deadline }}h | {{ $json.cbp.penalty_risk || 'File manifest immediately' }}"
      },
      "position": [
        850,
        200
      ]
    },
    {
      "id": "5",
      "name": "Email Customs Manager",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "customs@company.com",
        "subject": "CBP Manifest Alert \u2014 Shipment {{ $json.shipment_id }} | {{ $json.cbp.urgency }}",
        "message": "Shipment: {{ $json.shipment_id }}\nTier: {{ $json.tier }}\nManifest deadline: {{ $json.cbp.deadline_utc }}\nHours remaining: {{ $json.cbp.hours_to_deadline }}h\nFMC flags: {{ $json.fmc_flags.length }} issues\nCTPA status: {{ $json.ctpat_status }}\n\nRegulation: CBP Trade Act 2002 \u2014 24h advance manifest required\nPenalty: $5,000/shipment + Do Not Load if not filed in time"
      },
      "position": [
        850,
        350
      ]
    },
    {
      "id": "6",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "cbp_fmc_compliance_log",
        "columns": "shipment_id,tier,cbp_urgency,hours_to_deadline,fmc_flags,ctpat_status,logged_at",
        "values": "={{ $json.shipment_id }},={{ $json.tier }},={{ $json.cbp.urgency }},={{ $json.cbp.hours_to_deadline }},={{ JSON.stringify($json.fmc_flags) }},={{ $json.ctpat_status }},={{ new Date().toISOString() }}"
      },
      "position": [
        850,
        500
      ]
    },
    {
      "id": "7",
      "name": "Respond 200",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "responseCode": 200,
        "responseBody": "{\"status\":\"logged\",\"shipment_id\":\"={{ $json.shipment_id }}\"}"
      },
      "position": [
        1050,
        300
      ]
    }
  ],
  "connections": {
    "Shipment Event Webhook": {
      "main": [
        [
          {
            "node": "CBP/FMC Compliance Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "CBP/FMC Compliance Check": {
      "main": [
        [
          {
            "node": "Alert Required?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert Required?": {
      "main": [
        [
          {
            "node": "Slack #customs-compliance",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email Customs Manager",
            "type": "main",
            "index": 0
          },
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Log to Postgres": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

2. FMCSA ELD Hours-of-Service Violation Alert System

Polls ELD API every 30 minutes. Checks all four HOS limits simultaneously: 11-hour driving (per §395.3(a)(3)), 14-hour on-duty window (§395.3(a)(2)), 30-minute break after 8 driving hours (§395.3(a)(3)(ii)), and 60h/7-day or 70h/8-day cycle limit (§395.3(b)). Out-of-service violations trigger immediate Slack + DOT safety manager email. CSA BASIC score impact noted for each violation.

{
  "name": "FMCSA ELD Hours-of-Service Violation Alert System",
  "nodes": [
    {
      "id": "1",
      "name": "Every 30 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 30
            }
          ]
        }
      },
      "position": [
        250,
        300
      ]
    },
    {
      "id": "2",
      "name": "Pull ELD Driver Data",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "url": "https://eld-api.company.com/drivers/current-status",
        "authentication": "headerAuth"
      },
      "position": [
        450,
        300
      ]
    },
    {
      "id": "3",
      "name": "FMCSA HOS Analyzer",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "\n// FMCSA ELD Rule 49 CFR Part 395 \u2014 Hours of Service\n// ELD mandate: electronic logging required for CMV drivers (>10,000 lbs GVWR)\n// Property-carrying drivers:\n//   - 11h driving limit after 10 consecutive off-duty hours\n//   - 14h on-duty window (driving + non-driving combined)\n//   - 30-min break required after 8h of driving\n//   - 60h/7-day OR 70h/8-day cycle\n\nconst drivers = $json.drivers || [];\nconst violations = [];\nconst warnings = [];\n\nfor (const driver of drivers) {\n  const hosDriving = driver.hos_driving_today_hours || 0;\n  const hosOnDuty = driver.hos_on_duty_today_hours || 0;\n  const cycleHours = driver.hos_cycle_hours || 0;\n  const cycleType = driver.cycle_type || '70h8d';\n  const cycleLimit = cycleType === '60h7d' ? 60 : 70;\n  const drivingSinceBreak = driver.driving_since_break_hours || 0;\n\n  // 11-hour driving limit\n  if (hosDriving >= 11) {\n    violations.push({\n      driver_id: driver.driver_id,\n      name: driver.name,\n      type: 'HOS_11H_DRIVING_LIMIT_EXCEEDED',\n      severity: 'CRITICAL',\n      regulation: '49 CFR \u00a7395.3(a)(3) \u2014 Property-Carrying CMV',\n      detail: `${hosDriving}h driving (limit: 11h)`,\n      penalty: 'Out of service \u2014 CMV must stop immediately. $16,000+ fine per violation'\n    });\n  } else if (hosDriving >= 9.5) {\n    warnings.push({driver_id: driver.driver_id, type: 'HOS_11H_APPROACHING', hours_remaining: 11 - hosDriving});\n  }\n\n  // 14-hour on-duty window\n  if (hosOnDuty >= 14) {\n    violations.push({\n      driver_id: driver.driver_id,\n      name: driver.name,\n      type: 'HOS_14H_WINDOW_EXCEEDED',\n      severity: 'CRITICAL',\n      regulation: '49 CFR \u00a7395.3(a)(2) \u2014 14-hour on-duty window',\n      detail: `${hosOnDuty}h on-duty (window: 14h)`,\n      penalty: 'Driver OOS \u2014 no driving permitted until 10h off-duty reset'\n    });\n  }\n\n  // 30-min break requirement (after 8h driving)\n  if (drivingSinceBreak >= 8) {\n    violations.push({\n      driver_id: driver.driver_id,\n      name: driver.name,\n      type: 'HOS_30MIN_BREAK_REQUIRED',\n      severity: 'URGENT',\n      regulation: '49 CFR \u00a7395.3(a)(3)(ii) \u2014 30-minute break after 8h',\n      detail: `${drivingSinceBreak}h driving without 30min break`,\n      penalty: '$1,000\u2013$16,000 fine \u2014 driver must take 30min off-duty or sleeper berth break'\n    });\n  }\n\n  // Cycle limit\n  if (cycleHours >= cycleLimit) {\n    violations.push({\n      driver_id: driver.driver_id,\n      name: driver.name,\n      type: 'HOS_CYCLE_LIMIT_EXCEEDED',\n      severity: 'CRITICAL',\n      regulation: `49 CFR \u00a7395.3(b) \u2014 ${cycleType} cycle limit`,\n      detail: `${cycleHours}h/${cycleLimit}h cycle used`,\n      penalty: 'Driver must take 34h restart before resuming'\n    });\n  }\n}\n\nreturn [{json: {violations, warnings, violation_count: violations.length, warning_count: warnings.length, checked_at: new Date().toISOString()}}];\n"
      },
      "position": [
        650,
        300
      ]
    },
    {
      "id": "4",
      "name": "Violations Found?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{ $json.violation_count }}",
              "value2": 0,
              "operation": "larger"
            }
          ]
        }
      },
      "position": [
        850,
        300
      ]
    },
    {
      "id": "5",
      "name": "Slack #fmcsa-hos-alerts",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#fmcsa-hos-alerts",
        "text": "\ud83d\udea8 FMCSA HOS Violations: {{ $json.violation_count }} critical | {{ $json.violations.map(v => v.driver_id + ' ' + v.type).join(', ') }} | Out-of-service risk"
      },
      "position": [
        1050,
        200
      ]
    },
    {
      "id": "6",
      "name": "Email DOT Safety Manager",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "dot-safety@company.com",
        "subject": "FMCSA ELD HOS Violations \u2014 {{ $json.violation_count }} Drivers | {{ new Date().toISOString() }}",
        "message": "Active HOS Violations: {{ $json.violation_count }}\n\n{{ $json.violations.map(v => v.driver_id + ': ' + v.type + ' \u2014 ' + v.detail + ' \u2014 ' + v.penalty).join('\\n') }}\n\nRegulation: 49 CFR Part 395 ELD mandate\nFMCSA SMS score impact: HOS violations increase CSA BASIC score\nOut-of-service threshold: any 11h or 14h violation = immediate OOS"
      },
      "position": [
        1050,
        350
      ]
    },
    {
      "id": "7",
      "name": "Log Violations Postgres",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "fmcsa_hos_violations",
        "columns": "violation_count,violations_json,checked_at",
        "values": "={{ $json.violation_count }},={{ JSON.stringify($json.violations) }},={{ $json.checked_at }}"
      },
      "position": [
        1050,
        500
      ]
    }
  ],
  "connections": {
    "Every 30 Minutes": {
      "main": [
        [
          {
            "node": "Pull ELD Driver Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Pull ELD Driver Data": {
      "main": [
        [
          {
            "node": "FMCSA HOS Analyzer",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "FMCSA HOS Analyzer": {
      "main": [
        [
          {
            "node": "Violations Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Violations Found?": {
      "main": [
        [
          {
            "node": "Slack #fmcsa-hos-alerts",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email DOT Safety Manager",
            "type": "main",
            "index": 0
          },
          {
            "node": "Log Violations Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

3. FDA FSMA & EU CSDDD Supply Chain Due Diligence Tracker

Runs weekdays at 8AM. Reads supplier records from Google Sheets. Evaluates 12 deadline types across both frameworks: FSMA PCQI annual review, supplier audit, certificate of analysis review, lot traceability (FDA Traceability Rule Jan 2026), sanitary transport, recall plan — and CSDDD annual human rights audit, environmental impact assessment, grievance mechanism review, climate transition plan, plus SEC Scope 3 and C-TPAT renewal. 30-day advance warning window for upcoming deadlines.

{
  "name": "FDA FSMA & EU CSDDD Supply Chain Due Diligence Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      },
      "position": [
        250,
        300
      ]
    },
    {
      "id": "2",
      "name": "Read Supply Chain Suppliers",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "read",
        "sheetId": "SHEET_ID_SUPPLY_CHAIN",
        "range": "Suppliers!A:P"
      },
      "position": [
        450,
        300
      ]
    },
    {
      "id": "3",
      "name": "FSMA & CSDDD Analyzer",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "\n// FDA FSMA 21 CFR Part 117 \u2014 Current Good Manufacturing Practice, Hazard Analysis, Risk-Based Preventive Controls (HARPC)\n// PCQI (Preventive Controls Qualified Individual) required for each facility\n// Supplier verification required for raw materials: on-site audit, certificate of analysis, lot traceability\n// EU CSDDD Directive 2024/1760 \u2014 supply chain due diligence for human rights & environmental\n// Applies to EU companies >1000 employees / $450M turnover (or non-EU reaching same thresholds via EU sales)\n// Scope 3 supply chain: SEC Climate Disclosure Rule (large accelerated filers FY2026) / California SB 253 >$1B revenue\n\nconst rows = $input.all();\nconst today = new Date();\nconst alerts = [];\n\nconst DEADLINE_TYPES = {\n  'FSMA_PCQI_ANNUAL_REVIEW': {regulation: '21 CFR \u00a7117.126 \u2014 PCQI annual food safety plan review', days: 365, severity: 'CRITICAL'},\n  'FSMA_SUPPLIER_AUDIT': {regulation: '21 CFR \u00a7117.410 \u2014 Supplier verification on-site audit', days: 365, severity: 'CRITICAL'},\n  'FSMA_SUPPLIER_COA': {regulation: '21 CFR \u00a7117.410(b)(2) \u2014 Certificate of analysis review', days: 90, severity: 'URGENT'},\n  'FSMA_LOT_TRACEABILITY': {regulation: '21 CFR \u00a71.1310 \u2014 Food Traceability Rule lot traceability', days: 30, severity: 'URGENT'},\n  'FSMA_SANITARY_TRANSPORT': {regulation: '21 CFR Part 1 Subpart O \u2014 Sanitary transportation of food', days: 180, severity: 'WARNING'},\n  'CSDDD_HUMAN_RIGHTS_AUDIT': {regulation: 'EU CSDDD 2024/1760 Art.8 \u2014 Annual human rights due diligence', days: 365, severity: 'CRITICAL'},\n  'CSDDD_ENVIRONMENTAL_AUDIT': {regulation: 'EU CSDDD 2024/1760 Art.10 \u2014 Environmental impact assessment', days: 365, severity: 'CRITICAL'},\n  'CSDDD_GRIEVANCE_MECHANISM': {regulation: 'EU CSDDD 2024/1760 Art.14 \u2014 Grievance mechanism review', days: 180, severity: 'WARNING'},\n  'SCOPE3_EMISSIONS_REPORT': {regulation: 'SEC Climate Disclosure Rule / CA SB 253 \u2014 Scope 3 supply chain emissions', days: 90, severity: 'URGENT'},\n  'CTPAT_SECURITY_REVIEW': {regulation: 'C-TPAT CBP Partnership \u2014 Annual security profile review', days: 365, severity: 'WARNING'},\n  'FSMA_RECALL_PLAN': {regulation: '21 CFR \u00a7117.139 \u2014 Recall plan annual review', days: 365, severity: 'URGENT'},\n  'CSDDD_TRANSITION_PLAN': {regulation: 'EU CSDDD 2024/1760 Art.22 \u2014 Climate transition plan adoption', days: 365, severity: 'CRITICAL'}\n};\n\nfor (const row of rows) {\n  const supplier = row.json;\n  for (const [deadlineType, config] of Object.entries(DEADLINE_TYPES)) {\n    const lastCompletedKey = deadlineType.toLowerCase() + '_last_completed';\n    if (!supplier[lastCompletedKey]) continue;\n    const lastCompleted = new Date(supplier[lastCompletedKey]);\n    const nextDue = new Date(lastCompleted.getTime() + config.days * 24 * 60 * 60 * 1000);\n    const daysOverdue = Math.floor((today - nextDue) / (24 * 60 * 60 * 1000));\n\n    if (daysOverdue >= -30) {\n      alerts.push({\n        supplier_id: supplier.supplier_id,\n        supplier_name: supplier.supplier_name,\n        deadline_type: deadlineType,\n        severity: daysOverdue > 0 ? 'OVERDUE' : config.severity,\n        regulation: config.regulation,\n        days_overdue: daysOverdue,\n        next_due: nextDue.toISOString().split('T')[0],\n        tier: supplier.tier\n      });\n    }\n  }\n}\n\nconst overdue = alerts.filter(a => a.days_overdue > 0);\nconst critical = alerts.filter(a => a.days_overdue <= 0 && a.days_overdue >= -7);\nreturn [{json: {alerts, overdue_count: overdue.length, critical_count: critical.length, total_count: alerts.length, alert_required: overdue.length > 0 || critical.length > 0}}];\n"
      },
      "position": [
        650,
        300
      ]
    },
    {
      "id": "4",
      "name": "Alert Required?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.alert_required }}",
              "value2": true,
              "operation": "equal"
            }
          ]
        }
      },
      "position": [
        850,
        300
      ]
    },
    {
      "id": "5",
      "name": "Slack #supply-chain-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#supply-chain-compliance",
        "text": "\u26a0\ufe0f FSMA/CSDDD Supplier Alerts: {{ $json.overdue_count }} overdue, {{ $json.critical_count }} critical | {{ $json.total_count }} total issues | FDA recall risk + EU CSDDD \u20ac5M fine risk"
      },
      "position": [
        1050,
        200
      ]
    },
    {
      "id": "6",
      "name": "Email Supply Chain VP",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "supply-chain@company.com",
        "subject": "FSMA/CSDDD Supplier Compliance Alerts \u2014 {{ $json.overdue_count }} Overdue | {{ new Date().toISOString().split('T')[0] }}",
        "message": "Overdue supplier actions: {{ $json.overdue_count }}\n\nOverdue items:\n{{ $json.alerts.filter(a => a.days_overdue > 0).map(a => a.supplier_name + ' | ' + a.deadline_type + ' | ' + a.days_overdue + 'd overdue | ' + a.regulation).join('\\n') }}\n\nRegulations: FDA FSMA 21 CFR Part 117 / EU CSDDD 2024/1760 / SEC Scope 3\nFSMA penalty: warning letter + consent decree + criminal referral\nCSDDD penalty: up to \u20ac5M or 5% global turnover"
      },
      "position": [
        1050,
        350
      ]
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          {
            "node": "Read Supply Chain Suppliers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Read Supply Chain Suppliers": {
      "main": [
        [
          {
            "node": "FSMA & CSDDD Analyzer",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "FSMA & CSDDD Analyzer": {
      "main": [
        [
          {
            "node": "Alert Required?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert Required?": {
      "main": [
        [
          {
            "node": "Slack #supply-chain-compliance",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email Supply Chain VP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

4. Logistics Regulatory Deadline Monitor

Runs weekdays at 7AM. Covers 12 deadline types spanning the full regulatory stack: CBP entry summary (19 CFR §142.11, 10 working days), FMC detention dispute (30-day window from OSRA 2022), FMCSA ELD 6-month record retention, FMCSA new entrant safety audit (18 months), FSMA food safety plan review, FSMA Traceability Rule, CSDDD due diligence, Scope 3 reporting, C-TPAT renewal, DOT drug testing program, HAZMAT employee training (3-year cycle, 49 CFR Part 172 Subpart H, penalty $84,425/violation).

{
  "name": "Logistics Regulatory Deadline Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Weekdays 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1-5"
            }
          ]
        }
      },
      "position": [
        250,
        300
      ]
    },
    {
      "id": "2",
      "name": "Read Regulatory Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "read",
        "sheetId": "SHEET_ID_LOGISTICS_DEADLINES",
        "range": "Deadlines!A:M"
      },
      "position": [
        450,
        300
      ]
    },
    {
      "id": "3",
      "name": "Deadline Classifier",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "\nconst rows = $input.all();\nconst today = new Date();\n\nconst DEADLINE_TYPES = {\n  'CBP_ADVANCE_MANIFEST_24H': {regulation: 'CBP Trade Act 2002 \u2014 24h advance manifest', penalty: '$5,000/shipment + Do Not Load'},\n  'CBP_ENTRY_SUMMARY_10D': {regulation: '19 CFR \u00a7142.11 \u2014 Entry summary 10 working days', penalty: 'Liquidated damages 2x duties'},\n  'FMC_DETENTION_DISPUTE': {regulation: 'FMC Ocean Shipping Reform Act 2022 \u2014 30d dispute window', penalty: 'Forfeiture of dispute rights'},\n  'FMCSA_ELD_RETENTION_6M': {regulation: '49 CFR \u00a7395.8(k) \u2014 ELD records 6-month retention', penalty: '$1,000\u2013$16,000/violation'},\n  'FMCSA_SAFETY_AUDIT': {regulation: '49 CFR Part 385 \u2014 New entrant safety audit 18 months', penalty: 'Operating authority revocation'},\n  'FSMA_PCQI_REVIEW': {regulation: '21 CFR \u00a7117.126 \u2014 Annual food safety plan review', penalty: 'Warning letter + consent decree'},\n  'FSMA_TRACEABILITY_RULE': {regulation: '21 CFR \u00a71.1310 \u2014 Food Traceability Rule Jan 2026', penalty: 'Recall + criminal referral'},\n  'CSDDD_DUE_DILIGENCE': {regulation: 'EU CSDDD 2024/1760 \u2014 Annual supply chain audit', penalty: '\u20ac5M or 5% global turnover'},\n  'SCOPE3_EMISSIONS': {regulation: 'SEC Climate Disclosure / CA SB 253 \u2014 Scope 3 reporting', penalty: 'SEC enforcement + CA AG action'},\n  'CTPAT_RENEWAL': {regulation: 'C-TPAT CBP \u2014 Annual security profile update', penalty: 'Loss of expedited clearance'},\n  'DOT_DRUG_TESTING': {regulation: '49 CFR Part 40 \u2014 DOT drug and alcohol testing program', penalty: 'Safety violation + shutdown'},\n  'HAZMAT_TRAINING': {regulation: '49 CFR Part 172 Subpart H \u2014 Hazmat employee training 3yr', penalty: '$84,425/violation'}\n};\n\nconst classified = rows.map(r => {\n  const deadline = r.json;\n  const dueDate = new Date(deadline.due_date);\n  const daysRemaining = Math.floor((dueDate - today) / (24*60*60*1000));\n  const config = DEADLINE_TYPES[deadline.deadline_type] || {};\n\n  let urgency = 'NORMAL';\n  if (daysRemaining < 0) urgency = 'OVERDUE';\n  else if (daysRemaining <= 1) urgency = 'CRITICAL';\n  else if (daysRemaining <= 7) urgency = 'URGENT';\n  else if (daysRemaining <= 30) urgency = 'WARNING';\n\n  return {\n    ...deadline,\n    days_remaining: daysRemaining,\n    urgency,\n    regulation: config.regulation || deadline.regulation,\n    penalty: config.penalty || deadline.penalty,\n    alert_required: urgency !== 'NORMAL'\n  };\n});\n\nconst actionable = classified.filter(d => d.alert_required);\nconst overdue = actionable.filter(d => d.urgency === 'OVERDUE');\nreturn [{json: {deadlines: actionable, overdue_count: overdue.length, total_actionable: actionable.length, alert_required: actionable.length > 0}}];\n"
      },
      "position": [
        650,
        300
      ]
    },
    {
      "id": "4",
      "name": "Alert Required?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.alert_required }}",
              "value2": true,
              "operation": "equal"
            }
          ]
        }
      },
      "position": [
        850,
        300
      ]
    },
    {
      "id": "5",
      "name": "Slack #logistics-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#logistics-compliance",
        "text": "\u26a0\ufe0f Logistics Compliance Deadlines: {{ $json.overdue_count }} overdue, {{ $json.total_actionable }} total | CBP/FMCSA/FSMA/CSDDD action needed"
      },
      "position": [
        1050,
        200
      ]
    },
    {
      "id": "6",
      "name": "Email Compliance Director",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "compliance@company.com",
        "subject": "Logistics Regulatory Deadlines \u2014 {{ $json.overdue_count }} Overdue | {{ new Date().toISOString().split('T')[0] }}",
        "message": "{{ $json.deadlines.map(d => d.deadline_type + ' | ' + d.urgency + ' | ' + d.days_remaining + 'd | ' + d.regulation + ' | Penalty: ' + d.penalty).join('\\n') }}"
      },
      "position": [
        1050,
        350
      ]
    }
  ],
  "connections": {
    "Weekdays 7AM": {
      "main": [
        [
          {
            "node": "Read Regulatory Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Read Regulatory Deadlines": {
      "main": [
        [
          {
            "node": "Deadline Classifier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Deadline Classifier": {
      "main": [
        [
          {
            "node": "Alert Required?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert Required?": {
      "main": [
        [
          {
            "node": "Slack #logistics-compliance",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email Compliance Director",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

5. Weekly LogisticsTech SaaS Compliance KPI Dashboard

Monday 8AM. Queries Postgres for CBP/FMC incidents and FMCSA HOS violations from the previous 7 days. RAG status: RED if any DNL risk shipments or >3 HOS violations, AMBER if FMC disputes or any HOS warnings, GREEN otherwise. HTML email to VP Operations + COO. Self-hosting footnote included: FMCSA ELD data in third-party automation = driver privacy exposure + broader FMCSA audit scope.

{
  "name": "Weekly LogisticsTech SaaS Compliance KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      },
      "position": [
        250,
        300
      ]
    },
    {
      "id": "2",
      "name": "Query CBP/FMC Incidents",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as total_incidents, COUNT(CASE WHEN cbp_urgency = 'DO_NOT_LOAD_RISK' THEN 1 END) as dnl_risk, COUNT(CASE WHEN fmc_flags != '[]' THEN 1 END) as fmc_violations FROM cbp_fmc_compliance_log WHERE logged_at > NOW() - INTERVAL '7 days'"
      },
      "position": [
        450,
        200
      ]
    },
    {
      "id": "3",
      "name": "Query FMCSA Violations",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COALESCE(SUM(violation_count),0) as total_hos_violations, COUNT(*) as checks_run FROM fmcsa_hos_violations WHERE logged_at > NOW() - INTERVAL '7 days'"
      },
      "position": [
        450,
        400
      ]
    },
    {
      "id": "4",
      "name": "Merge KPI Data",
      "type": "n8n-nodes-base.merge",
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByPosition"
      },
      "position": [
        650,
        300
      ]
    },
    {
      "id": "5",
      "name": "Build KPI Dashboard",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "\nconst cbp = $input.first().json;\nconst fmcsa = $input.last().json;\n\nconst dnlRisk = parseInt(cbp.dnl_risk) || 0;\nconst fmcViolations = parseInt(cbp.fmc_violations) || 0;\nconst hosViolations = parseInt(fmcsa.total_hos_violations) || 0;\n\nlet rag = 'GREEN';\nlet ragReason = 'All logistics compliance metrics within normal range';\nif (dnlRisk > 0 || hosViolations > 3) {\n  rag = 'RED';\n  ragReason = dnlRisk > 0 ? `${dnlRisk} Do Not Load risk shipments this week` : `${hosViolations} FMCSA HOS violations \u2014 CSA score impact`;\n} else if (fmcViolations > 0 || hosViolations > 0) {\n  rag = 'AMBER';\n  ragReason = `${fmcViolations} FMC detention disputes + ${hosViolations} HOS warnings \u2014 monitor`;\n}\n\nconst ragColor = {RED: '#cc0000', AMBER: '#ff8800', GREEN: '#006600'};\nconst html = \\`<h2>LogisticsTech SaaS Weekly Compliance KPI</h2>\n<p><strong>Status: <span style=\"color:\\${ragColor[rag]}\">\\${rag}</span></strong> \u2014 \\${ragReason}</p>\n<table border=\"1\" cellpadding=\"8\">\n<tr><th>Metric</th><th>This Week</th><th>Regulation</th><th>Risk</th></tr>\n<tr><td>CBP Do Not Load Risk Shipments</td><td>\\${dnlRisk}</td><td>CBP Trade Act 2002 \u2014 24h advance manifest</td><td>\\${dnlRisk > 0 ? '\u26d4 $5K/shipment' : '\u2705'}</td></tr>\n<tr><td>FMC Prohibited Detention/Demurrage</td><td>\\${fmcViolations}</td><td>FMC Ocean Shipping Reform Act 2022</td><td>\\${fmcViolations > 0 ? '\u26a0\ufe0f Dispute required' : '\u2705'}</td></tr>\n<tr><td>FMCSA ELD HOS Violations</td><td>\\${hosViolations}</td><td>49 CFR Part 395 \u2014 Hours of Service</td><td>\\${hosViolations > 0 ? '\ud83d\udea8 OOS risk + CSA score' : '\u2705'}</td></tr>\n<tr><td>ELD Checks Run</td><td>\\${fmcsa.checks_run}</td><td>FMCSA ELD Mandate</td><td>\u2705</td></tr>\n</table>\n<p><em>Self-hosting note: FMCSA ELD data contains driver location + driving behavior \u2014 49 CFR \u00a7395.8 requires records available to authorized safety officials on demand. Zapier/Make = third-party server in ELD data chain = driver privacy exposure + FMCSA audit scope expansion.</em></p>\\`;\n\nreturn [{json: {html, rag, dnl_risk: dnlRisk, fmc_violations: fmcViolations, hos_violations: hosViolations}}];\n"
      },
      "position": [
        850,
        300
      ]
    },
    {
      "id": "6",
      "name": "Email VP Operations + COO",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "to": "vp-ops@company.com",
        "subject": "Weekly LogisticsTech Compliance KPI \u2014 {{ $json.rag }} | W/E {{ new Date().toISOString().split('T')[0] }}",
        "message": "={{ $json.html }}",
        "options": {
          "html": true
        }
      },
      "position": [
        1050,
        300
      ]
    }
  ],
  "connections": {
    "Monday 8AM": {
      "main": [
        [
          {
            "node": "Query CBP/FMC Incidents",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query FMCSA Violations",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query CBP/FMC Incidents": {
      "main": [
        [
          {
            "node": "Merge KPI Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query FMCSA Violations": {
      "main": [
        [
          {
            "node": "Merge KPI Data",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge KPI Data": {
      "main": [
        [
          {
            "node": "Build KPI Dashboard",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Dashboard": {
      "main": [
        [
          {
            "node": "Email VP Operations + COO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Tier reference

Tier	Primary regulations
3PL_SAAS	CBP + FMC + C-TPAT + FMCSA ELD + FSMA carrier
FREIGHT_BROKER_SAAS	CBP + FMC OSRA 2022 + FMCSA broker authority + C-TPAT
TMS_SAAS	CBP + FMCSA ELD + FMC + FSMA + CSDDD Scope 3
COLD_CHAIN_SAAS	FSMA PCQI + FDA Sanitary Transport + FMCSA + FSMA Temp Logging
CUSTOMS_BROKER_SAAS	CBP + 5106 entry + C-TPAT + OFAC screening + ACE filing
LAST_MILE_DELIVERY_SAAS	FMCSA ELD + DOT safety + CCPA driver data + HOS
LOGISTICS_STARTUP	CBP + FMCSA ELD + FSMA + FMC

Implementation notes

These workflows require: Google Sheets for deadline tracking, Postgres for audit logging (CBP, FMCSA, supplier data), Slack for operational alerts, Gmail for compliance notifications, and webhook endpoints for ELD and shipment systems. All JSON above is production-ready — configure credentials, set Sheets IDs, and deploy.

Store: All workflows available individually and as a bundle at stripeai.gumroad.com — each includes deployment instructions and configuration guides.

Tags: CBP advance manifest, FMCSA ELD compliance, FDA FSMA automation, EU CSDDD supply chain, n8n logistics, supply chain SaaS compliance

n8n for RegTech/Compliance SaaS: 5 Automations for FinCEN BSA/AML, SEC 17a-4 WORM, OFAC SDN, MiCA, and CFTC — Free JSON

Alex Kane — Thu, 28 May 2026 22:19:54 +0000

If your compliance software platform sits between financial institutions and their regulators — and you're using Zapier or Make to run BSA/AML alerts, OFAC screenings, or SEC record-keeping workflows — you have a problem that your sales team hasn't talked to your compliance officer about yet.

Here's the issue: FinCEN BSA/AML SAR data flowing through a third-party iPaaS vendor's servers is a potential 31 USC §5318(g)(2) tipping-off violation. The anti-tipping-off provision doesn't just prohibit you from telling the subject their account is flagged — it prohibits disclosure to any person involved in the transaction. If Zapier processes your SAR routing, Zapier employees with infrastructure access are potentially 'persons' in the chain.

This isn't hypothetical. The FinCEN SAR Activity Review (2023) specifically flags automation vendor data custody as an emerging BSA compliance risk. OCC and FDIC examination teams have started asking about third-party system access to SAR-triggering transaction data in bank technology reviews.

The RegTech/Compliance SaaS Stack

RegTech and compliance software vendors face a recursive problem: you sell compliance, so your own compliance posture is under a microscope. Your clients' regulators (OCC, FINRA, CFTC, ESMA) view your platform as part of their clients' regulated infrastructure.

The seven RegTech SaaS buyer segments each have a distinct regulatory stack:

Tier	Key Regulations	Fastest Clock
Bank Compliance SaaS	FinCEN BSA/AML, OFAC, FFIEC, OCC	SAR: 30 days from discovery (31 CFR §1020.320)
Broker-Dealer SaaS	SEC Rule 17a-4 WORM, FINRA 4511, Reg SCI	WORM: same-day record integrity
Investment Adviser SaaS	SEC Rule 204-2, Form ADV annual, Reg BI	Books & records: 5-year retention
Crypto Exchange SaaS	EU MiCA Art.59, FinCEN MSB, FATF R16 Travel Rule	Market abuse: 1 business day to ESMA/NCA
Payments Compliance SaaS	FinCEN BSA, FATF R16, PSD2 Art.89	FATF Travel Rule: per-transfer
Insurance Compliance SaaS	NAIC Model #668, GLBA, TCPA FCC 23-107	NAIC breach: 3-day investigation
RegTech Startup	Multi-framework awareness, SOC2 Type II, GDPR Art.28	SOC2 audit cycle

5 n8n Automations for RegTech/Compliance SaaS

Workflow 1: FinCEN BSA/AML SAR & OFAC Screening Pipeline

Every bank compliance SaaS platform needs a transaction monitoring pipeline that correctly separates the Currency Transaction Report (CTR) clock (15 calendar days, 31 CFR §1010.310) from the Suspicious Activity Report (SAR) clock (30 days from discovery of suspicious activity, 60 days if no suspect identified — 31 USC §5318(g) + 31 CFR §1020.320). Most platforms conflate these.

Critical detail: OFAC SDN screening happens before any SAR determination. An OFAC hit is not a SAR — it's a blocking action with a separate 10-day blocking report requirement (31 CFR §501.604). If your platform routes both through the same alert pipeline, you're mixing two fundamentally different regulatory responses with different timelines and different regulators.

{
  "name": "FinCEN BSA/AML SAR & OFAC Screening Pipeline",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "bsa-aml-pipeline",
        "responseMode": "responseNode",
        "options": {}
      },
      "id": "n1",
      "name": "Transaction Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        240,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const tx = $json;\nconst amount = tx.amount_usd || 0;\nconst txType = tx.transaction_type || 'WIRE';\nconst customerName = tx.customer_name || '';\nconst country = tx.originating_country || 'US';\n\nconst HIGH_RISK_COUNTRIES = ['IR','KP','CU','SY','RU','BY','VE'];\nconst OFAC_WATCHLIST = tx.ofac_score || 0;\n\nlet alertType, urgency, clock, regulation, action;\n\nif (OFAC_WATCHLIST >= 85) {\n  alertType = 'OFAC_SDN_HIT';\n  urgency = 'IMMEDIATE';\n  clock = '10 calendar days';\n  regulation = '31 CFR \u00a7501.604 \u2014 OFAC Blocking Report required within 10 days';\n  action = 'BLOCK transaction, file OFAC Blocking Report, freeze account, notify OFAC';\n} else if (OFAC_WATCHLIST >= 60) {\n  alertType = 'OFAC_POSSIBLE_MATCH';\n  urgency = '4_HOURS';\n  clock = '4 hours';\n  regulation = '31 CFR \u00a7501.604 \u2014 enhanced due diligence required before release';\n  action = 'HOLD transaction, assign OFAC analyst for manual review within 4h';\n} else if (amount >= 10000 && ['CASH_DEPOSIT','CASH_WITHDRAWAL','CURRENCY_EXCHANGE'].includes(txType)) {\n  alertType = 'CTR_REQUIRED';\n  urgency = 'URGENT';\n  clock = '15 calendar days';\n  regulation = '31 CFR \u00a71010.310 \u2014 Currency Transaction Report due within 15 days';\n  action = 'File FinCEN CTR (FinCEN Form 112) by ' + new Date(Date.now() + 15*86400000).toISOString().split('T')[0];\n} else if (amount >= 5000 && (HIGH_RISK_COUNTRIES.includes(country) || tx.structuring_flag || tx.layering_flag)) {\n  alertType = 'SAR_REQUIRED';\n  urgency = 'CRITICAL';\n  clock = '30 calendar days (60 if no suspect ID)';\n  regulation = '31 USC \u00a75318(g) + 31 CFR \u00a71020.320 \u2014 SAR due 30 days from discovery, 60 if no suspect';\n  action = 'File FinCEN SAR (FinCEN Form 111). DO NOT tip off subject (31 USC \u00a75318(g)(2) tipping-off prohibition)';\n} else if (tx.pep_flag) {\n  alertType = 'PEP_EDD_REQUIRED';\n  urgency = 'URGENT';\n  clock = '5 business days';\n  regulation = 'FinCEN CDD Rule 31 CFR \u00a71010.230(e)(2) \u2014 PEP Enhanced Due Diligence';\n  action = 'Initiate PEP Enhanced Due Diligence procedure within 5 business days';\n} else {\n  alertType = 'AML_MONITORING_CLEAR';\n  urgency = 'INFO';\n  clock = null;\n  regulation = '31 CFR \u00a71010 \u2014 transaction logged for annual SAR lookback';\n  action = 'Log to AML monitoring database for 5-year retention (31 CFR \u00a71010.430)';\n}\n\nconst deadlineTs = clock && !['IMMEDIATE','4_HOURS'].includes(urgency)\n  ? new Date(Date.now() + (alertType === 'SAR_REQUIRED' ? 30*86400000 : alertType === 'CTR_REQUIRED' ? 15*86400000 : 5*86400000)).toISOString()\n  : null;\n\nreturn [{ json: { ...tx, alertType, urgency, clock, regulation, action, deadlineTs, ofac_score: OFAC_WATCHLIST, customer_name: customerName, tipping_off_warning: alertType === 'SAR_REQUIRED' ? '31 USC \u00a75318(g)(2): Do NOT disclose SAR existence to subject or any person involved in the transaction' : null } }];"
      },
      "id": "n2",
      "name": "BSA/OFAC Risk Assessment",
      "type": "n8n-nodes-base.code",
      "position": [
        460,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.urgency }}",
              "operation": "isNotEmpty"
            }
          ]
        },
        "combineOperation": "any"
      },
      "id": "n3",
      "name": "Alert Required?",
      "type": "n8n-nodes-base.if",
      "position": [
        680,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "oAuth2",
        "resource": "message",
        "operation": "sendMessage",
        "chatId": "#bsa-aml-alerts",
        "text": "=\ud83d\udea8 *{{ $json.alertType }}* | {{ $json.urgency }}\n\n*Customer:* {{ $json.customer_name }}\n*Amount:* ${{ $json.amount_usd?.toLocaleString() }}\n*Transaction:* {{ $json.transaction_type }}\n*OFAC Score:* {{ $json.ofac_score }}/100\n\n*Regulation:* {{ $json.regulation }}\n*Required Action:* {{ $json.action }}\n*Deadline:* {{ $json.deadlineTs || 'IMMEDIATE' }}\n\n{{ $json.tipping_off_warning ? '\u26a0\ufe0f TIPPING-OFF WARNING: ' + $json.tipping_off_warning : '' }}"
      },
      "id": "n4",
      "name": "Slack BSA Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        900,
        200
      ]
    },
    {
      "parameters": {
        "fromEmail": "bsa-officer@yourcompany.com",
        "toEmail": "bsa-officer@yourcompany.com",
        "subject": "=[{{ $json.urgency }}] {{ $json.alertType }} \u2014 {{ $json.customer_name }} (${{ $json.amount_usd }})",
        "text": "=BSA/AML ALERT\n\nAlert Type: {{ $json.alertType }}\nUrgency: {{ $json.urgency }}\nRegulation: {{ $json.regulation }}\n\nTransaction Details:\n- Customer: {{ $json.customer_name }}\n- Amount: ${{ $json.amount_usd }}\n- Type: {{ $json.transaction_type }}\n- Country: {{ $json.originating_country }}\n- OFAC Score: {{ $json.ofac_score }}/100\n\nRequired Action: {{ $json.action }}\nDeadline: {{ $json.deadlineTs || 'IMMEDIATE ACTION REQUIRED' }}\n\n{{ $json.tipping_off_warning || '' }}\n\nn8n self-hosted: SAR data never transits third-party iPaaS infrastructure. 31 USC \u00a75318(g)(2) tipping-off prohibition compliance maintained."
      },
      "id": "n5",
      "name": "Email BSA Officer",
      "type": "n8n-nodes-base.gmail",
      "position": [
        900,
        350
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "=INSERT INTO bsa_sar_log (customer_name, amount_usd, transaction_type, alert_type, urgency, regulation, action_required, deadline_ts, ofac_score, tipping_off_flag, created_at) VALUES ('{{ $json.customer_name }}', {{ $json.amount_usd }}, '{{ $json.transaction_type }}', '{{ $json.alertType }}', '{{ $json.urgency }}', '{{ $json.regulation }}', '{{ $json.action }}', {{ $json.deadlineTs ? \"'\" + $json.deadlineTs + \"'\" : 'NULL' }}, {{ $json.ofac_score }}, {{ $json.alertType === 'SAR_REQUIRED' ? 'TRUE' : 'FALSE' }}, NOW())"
      },
      "id": "n6",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "position": [
        900,
        500
      ]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{ JSON.stringify({ received: true, alertType: $json.alertType, urgency: $json.urgency, deadline: $json.deadlineTs }) }}"
      },
      "id": "n7",
      "name": "Respond 200",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        900,
        650
      ]
    }
  ],
  "connections": {
    "Transaction Webhook": {
      "main": [
        [
          {
            "node": "BSA/OFAC Risk Assessment",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "BSA/OFAC Risk Assessment": {
      "main": [
        [
          {
            "node": "Alert Required?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert Required?": {
      "main": [
        [
          {
            "node": "Slack BSA Alert",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email BSA Officer",
            "type": "main",
            "index": 0
          },
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          },
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Self-hosting argument for bank clients: The 31 USC §5318(g)(2) anti-tipping-off provision prohibits disclosing the existence of a SAR to the subject or any person involved in the transaction. SAR data in Zapier's infrastructure introduces third-party server access to SAR-triggering transaction patterns. Self-hosted n8n keeps all SAR routing within your perimeter — no third-party data custody.

Workflow 2: SEC Rule 17a-4 WORM Record Retention Compliance Monitor

SEC Rule 17a-4 requires broker-dealers to maintain records in non-rewriteable, non-erasable storage (WORM). The rule specifies different retention periods by record type: trade confirmations (3 years, 17a-4(b)(1)), blotters and ledgers (6 years, 17a-4(b)(2)), customer records (6 years, 17a-4(b)(4)), business communications (3 years, 17a-4(b)(4)), and AML records (5 years, 31 CFR §1010.430).

FINRA Rule 4511 runs parallel to 17a-4 and explicitly requires that records be maintained in the format specified by SEC rules. A WORM integrity failure is a per se violation — no intent required, no 'reasonable mistake' defense in broker-dealer examination.

{
  "name": "SEC Rule 17a-4 WORM Record Retention Compliance Monitor",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 6 * * *"
            }
          ]
        }
      },
      "id": "n1",
      "name": "Daily 6AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        240,
        300
      ]
    },
    {
      "parameters": {
        "operation": "read",
        "documentId": "YOUR_SHEETS_ID",
        "sheetName": "retention_records"
      },
      "id": "n2",
      "name": "Read Retention Records",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        460,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const records = $input.all().map(i => i.json);\nconst now = new Date();\nconst alerts = [];\n\nconst RECORD_TYPES_17A4 = {\n  'TRADE_CONFIRMATION': { retention_years: 3, regulation: 'SEC Rule 17a-4(b)(1)' },\n  'BLOTTER': { retention_years: 6, regulation: 'SEC Rule 17a-4(b)(2)' },\n  'GENERAL_LEDGER': { retention_years: 6, regulation: 'SEC Rule 17a-4(b)(2)' },\n  'CUSTOMER_RECORD': { retention_years: 6, regulation: 'SEC Rule 17a-4(b)(4)' },\n  'BUSINESS_COMMUNICATION': { retention_years: 3, regulation: 'SEC Rule 17a-4(b)(4) + FINRA 4511' },\n  'AML_RECORD': { retention_years: 5, regulation: '31 CFR \u00a71010.430 BSA record retention' },\n  'SAR_RECORD': { retention_years: 5, regulation: '31 CFR \u00a71010.430 \u2014 Note: SAR existence is confidential' },\n  'OPTIONS_RECORD': { retention_years: 3, regulation: 'SEC Rule 17a-4(b)(7)' },\n  'CUSTOMER_COMPLAINT': { retention_years: 4, regulation: 'FINRA Rule 4513' },\n  'FINANCIAL_STATEMENT': { retention_years: 6, regulation: 'SEC Rule 17a-4(b)(2)' },\n  'EXAM_CORRESPONDENCE': { retention_years: 3, regulation: 'SEC Rule 17a-4(b)(4)' },\n  'FOCUS_REPORT': { retention_years: 6, regulation: 'SEC Rule 17a-4(b)(2) + FINRA 4511' }\n};\n\nfor (const rec of records) {\n  const worm_ok = rec.write_once_verified === 'TRUE';\n  const expires = rec.retention_expires_date ? new Date(rec.retention_expires_date) : null;\n  const daysUntilExpiry = expires ? Math.floor((expires - now) / 86400000) : null;\n  const info = RECORD_TYPES_17A4[rec.record_type] || {};\n\n  if (!worm_ok) {\n    alerts.push({ ...rec, alertType: 'WORM_INTEGRITY_FAILURE', urgency: 'CRITICAL', regulation: `${info.regulation || 'SEC Rule 17a-4'} \u2014 WORM non-compliant record. SEC requires non-rewriteable, non-erasable storage (17a-4(f)(2)(ii)(A))`, action: 'Immediately verify WORM storage. Broker-dealer exam finding: SEC can order disgorgement for record-keeping violations. FINRA 4511 parallel violation.' });\n  } else if (daysUntilExpiry !== null && daysUntilExpiry < 0) {\n    alerts.push({ ...rec, alertType: 'RETENTION_OVERDUE', urgency: 'CRITICAL', daysOverdue: Math.abs(daysUntilExpiry), regulation: `${info.regulation} \u2014 record past retention end date`, action: `Disposition required. If no litigation hold: schedule for WORM purge per 17a-4(f)(3)(iv) disposal log requirement` });\n  } else if (daysUntilExpiry !== null && daysUntilExpiry <= 30) {\n    alerts.push({ ...rec, alertType: 'RETENTION_EXPIRING_30D', urgency: 'WARNING', daysRemaining: daysUntilExpiry, regulation: `${info.regulation} \u2014 retention window closing`, action: `Verify no litigation hold (FRCP 37(e)). If hold active: extend. If clear: schedule disposal with 17a-4(f)(3)(iv) disposal log entry` });\n  }\n}\n\nreturn alerts.length > 0 ? alerts.map(a => ({json: a})) : [{json: {status: 'ALL_RECORDS_COMPLIANT', checked: records.length, timestamp: now.toISOString()}}];"
      },
      "id": "n3",
      "name": "Check WORM Compliance",
      "type": "n8n-nodes-base.code",
      "position": [
        680,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.alertType }}",
              "value2": "WORM_INTEGRITY_FAILURE",
              "operation": "equals"
            }
          ]
        }
      },
      "id": "n4",
      "name": "WORM Failure?",
      "type": "n8n-nodes-base.if",
      "position": [
        900,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "oAuth2",
        "resource": "message",
        "operation": "sendMessage",
        "chatId": "#records-management",
        "text": "=\u26a0\ufe0f *{{ $json.alertType }}* | {{ $json.urgency }}\n\n*Record:* {{ $json.record_id }} ({{ $json.record_type }})\n*Regulation:* {{ $json.regulation }}\n*Action:* {{ $json.action }}\n{{ $json.daysOverdue ? 'Overdue by: ' + $json.daysOverdue + ' days' : '' }}\n{{ $json.daysRemaining !== undefined ? 'Days remaining: ' + $json.daysRemaining : '' }}"
      },
      "id": "n5",
      "name": "Slack Records Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        1120,
        200
      ]
    },
    {
      "parameters": {
        "fromEmail": "cco@yourcompany.com",
        "toEmail": "cco@yourcompany.com",
        "subject": "=CRITICAL: WORM Integrity Failure \u2014 {{ $json.record_id }} ({{ $json.record_type }})",
        "text": "=WORM record integrity failure detected.\n\nRecord ID: {{ $json.record_id }}\nType: {{ $json.record_type }}\nRegulation: {{ $json.regulation }}\nRequired Action: {{ $json.action }}\n\nSEC Rule 17a-4(f)(2)(ii)(A) requires non-rewriteable, non-erasable storage.\nFINRA Rule 4511 requires maintenance of all books and records in 17a-4 format.\n\nExam risk: FINRA/SEC record-keeping violation is a per se violation \u2014 no intent required."
      },
      "id": "n6",
      "name": "Email CCO + General Counsel",
      "type": "n8n-nodes-base.gmail",
      "position": [
        1120,
        400
      ]
    }
  ],
  "connections": {
    "Daily 6AM": {
      "main": [
        [
          {
            "node": "Read Retention Records",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Read Retention Records": {
      "main": [
        [
          {
            "node": "Check WORM Compliance",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check WORM Compliance": {
      "main": [
        [
          {
            "node": "WORM Failure?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "WORM Failure?": {
      "main": [
        [
          {
            "node": "Slack Records Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email CCO + General Counsel",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Self-hosting argument: SEC Rule 17a-4(f)(3)(i) requires records to be available for examination within 1 business day (4 hours for emergency production). If your automation platform for WORM compliance monitoring is itself Zapier — and Zapier has an outage during an SEC examination — you have a records production failure on top of the original WORM alert. Self-hosted n8n execution logs are part of your own WORM-compliant infrastructure, not a separate vendor's.

Workflow 3: EU MiCA / CFTC Part 45 Regulatory Reporting Deadline Monitor

EU MiCA (Regulation 2023/1114, effective December 2024) created a new class of regulatory reporting obligation for crypto-asset service providers and asset-referenced token issuers. MiCA Art.59 market abuse reports to ESMA/NCA are due within 1 business day of detection — faster than most traditional financial reporting clocks.

CFTC Part 45 swap data repository reporting operates on a different clock: continuation data (life cycle events for existing swaps) must be reported by the next business day. If your RegTech platform serves both EU crypto clients and US swap dealer clients, you're managing fundamentally different reporting cadences to different regulators on the same underlying infrastructure.

{
  "name": "EU MiCA / CFTC Part 45 Regulatory Reporting Deadline Monitor",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      },
      "id": "n1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        240,
        300
      ]
    },
    {
      "parameters": {
        "operation": "read",
        "documentId": "YOUR_SHEETS_ID",
        "sheetName": "regulatory_reporting_deadlines"
      },
      "id": "n2",
      "name": "Read Reporting Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        460,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const rows = $input.all().map(r => r.json);\nconst now = new Date();\nconst bizDayMs = 86400000;\nconst alerts = [];\n\nconst DEADLINE_TYPES = {\n  'MICA_ART59_MARKET_ABUSE': { biz_days: 1, regulation: 'MiCA Art.59 \u2014 market abuse reporting to ESMA/NCA within 1 business day of detection', regulator: 'ESMA + national NCA' },\n  'MICA_ART76_WHITEPAPER_UPDATE': { biz_days: 5, regulation: 'MiCA Art.76 \u2014 crypto-asset white paper material change notification within 5 business days', regulator: 'NCA' },\n  'MICA_ART88_PERIODIC': { biz_days: 5, regulation: 'MiCA Art.88 \u2014 periodic reporting for significant ART/EMT issuers', regulator: 'EBA/ESMA' },\n  'CFTC_PART45_SWAP_DATA': { biz_days: 1, regulation: 'CFTC Part 45 \u2014 swap data repository reporting within 1 business day of execution (17 CFR \u00a745.3)', regulator: 'CFTC via SDR' },\n  'CFTC_PART45_CONTINUATION': { biz_days: 1, regulation: 'CFTC Part 45 \u2014 continuation data (life cycle events) next business day', regulator: 'CFTC via SDR' },\n  'FATF_TRAVEL_RULE_1K': { biz_days: 1, regulation: 'FATF Recommendation 16 + FinCEN CVC Travel Rule \u2014 wire transfers \u2265$1,000 require originator+beneficiary info', regulator: 'FinCEN/OFAC' },\n  'FINRA_4511_RECORDS': { biz_days: 1, regulation: 'FINRA Rule 4511 \u2014 all books and records in 17a-4 format, missing entry same-day flag', regulator: 'FINRA' },\n  'SEC_17A4_EXAMINATION': { biz_days: 5, regulation: 'SEC Rule 17a-4(f)(3)(i) \u2014 records available for examination within 1 business day (emergency within 4h)', regulator: 'SEC EXAMS' },\n  'OCC_BANK_EXAM_RESPONSE': { biz_days: 5, regulation: 'OCC Examination Policies Manual \u2014 MRA/MRIA response due within specified timeframe', regulator: 'OCC' },\n  'MICA_CASP_LICENSE_ANNUAL': { biz_days: 30, regulation: 'MiCA Art.62 \u2014 CASP annual regulatory report to home NCA', regulator: 'NCA' },\n  'EU_AML_6AMLD_SAR': { biz_days: 1, regulation: 'EU 6AMLD Directive 2018/1673 + national FIU \u2014 suspicious transaction report within 1 business day', regulator: 'National FIU' },\n  'OFAC_BLOCKING_REPORT': { biz_days: 10, regulation: '31 CFR \u00a7501.604 \u2014 OFAC blocking report within 10 business days of blocking action', regulator: 'OFAC' }\n};\n\nfor (const row of rows) {\n  const info = DEADLINE_TYPES[row.deadline_type] || {};\n  const deadline = row.deadline_date ? new Date(row.deadline_date) : null;\n  if (!deadline) continue;\n  const daysLeft = Math.floor((deadline - now) / bizDayMs);\n  let urgency;\n  if (daysLeft < 0) urgency = 'OVERDUE';\n  else if (daysLeft <= 1) urgency = 'CRITICAL';\n  else if (daysLeft <= 3) urgency = 'URGENT';\n  else if (daysLeft <= 10) urgency = 'WARNING';\n  else urgency = 'NOTICE';\n\n  if (['OVERDUE','CRITICAL','URGENT'].includes(urgency)) {\n    alerts.push({ ...row, alertType: 'REPORTING_DEADLINE_ALERT', urgency, daysLeft, regulation: info.regulation, regulator: info.regulator });\n  }\n}\n\nreturn alerts.length > 0 ? alerts.map(a => ({json: a})) : [{json: {status: 'NO_CRITICAL_DEADLINES', checked: rows.length}}];"
      },
      "id": "n3",
      "name": "Check Reporting Deadlines",
      "type": "n8n-nodes-base.code",
      "position": [
        680,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "oAuth2",
        "resource": "message",
        "operation": "sendMessage",
        "chatId": "#regulatory-reporting",
        "text": "=\ud83d\udccb *{{ $json.urgency }}* \u2014 {{ $json.deadline_type }}\n\n*Regulation:* {{ $json.regulation }}\n*Regulator:* {{ $json.regulator }}\n*Deadline:* {{ $json.deadline_date }}\n*Days Left:* {{ $json.daysLeft }}"
      },
      "id": "n4",
      "name": "Slack CRO Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        900,
        300
      ]
    },
    {
      "parameters": {
        "fromEmail": "cro@yourcompany.com",
        "toEmail": "cro@yourcompany.com",
        "subject": "=[{{ $json.urgency }}] Regulatory Reporting Deadline: {{ $json.deadline_type }}",
        "text": "=Regulatory reporting deadline approaching.\n\nType: {{ $json.deadline_type }}\nUrgency: {{ $json.urgency }}\nDays Remaining: {{ $json.daysLeft }}\nDeadline Date: {{ $json.deadline_date }}\nRegulation: {{ $json.regulation }}\nRegulator: {{ $json.regulator }}\n\nAction: Review {{ $json.reporting_item }} and ensure submission to {{ $json.regulator }} by deadline."
      },
      "id": "n5",
      "name": "Email CRO",
      "type": "n8n-nodes-base.gmail",
      "position": [
        900,
        450
      ]
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          {
            "node": "Read Reporting Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Read Reporting Deadlines": {
      "main": [
        [
          {
            "node": "Check Reporting Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Reporting Deadlines": {
      "main": [
        [
          {
            "node": "Slack CRO Alert",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email CRO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

FATF Recommendation 16 Travel Rule detail: For crypto exchange SaaS platforms: the FinCEN CVC Travel Rule requires originator and beneficiary information to accompany all wire transfers ≥$3,000 (31 CFR §1010.410(f)) and ≥$1,000 for virtual asset transfers under FinCEN's 2019 guidance. FATF R16 sets the international standard at $1,000 USD equivalent. If your platform processes transfers in multiple jurisdictions, you're managing two different thresholds simultaneously — $1,000 internationally, $3,000 domestically — with the same underlying transaction data.

Workflow 4: OFAC SDN Real-Time Screening & Blocking Pipeline

OFAC SDN screening is not optional and not periodic — it must happen at onboarding and at transaction initiation. The OFAC 50% Rule (published August 2014) means that an entity 50%+ owned by a blocked person is itself blocked, regardless of whether it appears on the SDN list. Your screening logic must account for beneficial ownership, not just direct name matches.

{
  "name": "OFAC SDN Real-Time Screening & Blocking Pipeline",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "ofac-screen",
        "responseMode": "responseNode",
        "options": {}
      },
      "id": "n1",
      "name": "Screening Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        240,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const subject = $json;\nconst name = (subject.entity_name || subject.person_name || '').toUpperCase();\nconst country = (subject.country || '').toUpperCase();\nconst entityType = subject.entity_type || 'PERSON';\nconst ofacScore = subject.ofac_score || 0;\n\nconst SANCTIONED_COUNTRIES = ['IR','KP','CU','SY','BY'];\nconst MONITORED_JURISDICTIONS = ['RU','VE','MM','ZW','LY'];\n\nlet result, urgency, disposition, blockingDeadline, regulatoryNote;\n\nif (ofacScore >= 85 || SANCTIONED_COUNTRIES.includes(country)) {\n  result = 'OFAC_SDN_HIT';\n  urgency = 'IMMEDIATE';\n  disposition = 'BLOCK';\n  blockingDeadline = new Date(Date.now() + 10*86400000).toISOString().split('T')[0];\n  regulatoryNote = '31 CFR \u00a7501.604: File OFAC Blocking Report within 10 business days. IEEPA authority. No property may be transferred, paid, exported, withdrawn \u2014 all dealings PROHIBITED.';\n} else if (ofacScore >= 60 || MONITORED_JURISDICTIONS.includes(country)) {\n  result = 'OFAC_POSSIBLE_MATCH';\n  urgency = '4_HOURS';\n  disposition = 'HOLD_FOR_REVIEW';\n  blockingDeadline = null;\n  regulatoryNote = 'Enhanced due diligence required. Verify against OFAC SDN List at sanctionssearch.ofac.treas.gov. OFAC 50% Rule: entity 50%+ owned by blocked person = blocked regardless of list status.';\n} else if (ofacScore >= 30) {\n  result = 'OFAC_EDD_FLAG';\n  urgency = 'REVIEW';\n  disposition = 'FLAG_FOR_EDD';\n  blockingDeadline = null;\n  regulatoryNote = 'Risk-based enhanced due diligence. Review ultimate beneficial ownership (FinCEN CDD Rule 31 CFR \u00a71010.230) and verify no OFAC 50% Rule application.';\n} else {\n  result = 'OFAC_CLEAR';\n  urgency = 'INFO';\n  disposition = 'PROCEED';\n  blockingDeadline = null;\n  regulatoryNote = 'Screening passed. Log result for 5-year retention (31 CFR \u00a71010.430 BSA record-keeping).';\n}\n\nreturn [{ json: { ...subject, ofacResult: result, urgency, disposition, blockingDeadline, regulatoryNote, screenedAt: new Date().toISOString() } }];"
      },
      "id": "n2",
      "name": "OFAC Risk Scoring",
      "type": "n8n-nodes-base.code",
      "position": [
        460,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.disposition }}",
              "value2": "BLOCK",
              "operation": "equals"
            }
          ]
        }
      },
      "id": "n3",
      "name": "Block?",
      "type": "n8n-nodes-base.if",
      "position": [
        680,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "oAuth2",
        "resource": "message",
        "operation": "sendMessage",
        "chatId": "#ofac-screening",
        "text": "=\ud83d\udd34 *{{ $json.ofacResult }}* | {{ $json.urgency }}\n\n*Entity:* {{ $json.entity_name || $json.person_name }}\n*Country:* {{ $json.country }}\n*OFAC Score:* {{ $json.ofac_score }}/100\n*Disposition:* {{ $json.disposition }}\n*Blocking Report Deadline:* {{ $json.blockingDeadline || 'N/A' }}\n\n*Regulatory Note:* {{ $json.regulatoryNote }}"
      },
      "id": "n4",
      "name": "Slack OFAC Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        900,
        200
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "=INSERT INTO ofac_screen_log (entity_name, country, ofac_score, ofac_result, disposition, blocking_deadline, regulatory_note, screened_at) VALUES ('{{ $json.entity_name || $json.person_name }}', '{{ $json.country }}', {{ $json.ofac_score }}, '{{ $json.ofacResult }}', '{{ $json.disposition }}', {{ $json.blockingDeadline ? \"'\" + $json.blockingDeadline + \"'\" : 'NULL' }}, '{{ $json.regulatoryNote?.replace(/'/g, \"''\") }}', NOW())"
      },
      "id": "n5",
      "name": "Postgres Screen Log",
      "type": "n8n-nodes-base.postgres",
      "position": [
        900,
        400
      ]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{ JSON.stringify({ ofacResult: $json.ofacResult, disposition: $json.disposition, blockingDeadline: $json.blockingDeadline, screenedAt: $json.screenedAt }) }}"
      },
      "id": "n6",
      "name": "Respond with Result",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        900,
        600
      ]
    }
  ],
  "connections": {
    "Screening Webhook": {
      "main": [
        [
          {
            "node": "OFAC Risk Scoring",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OFAC Risk Scoring": {
      "main": [
        [
          {
            "node": "Block?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Block?": {
      "main": [
        [
          {
            "node": "Slack OFAC Alert",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres Screen Log",
            "type": "main",
            "index": 0
          },
          {
            "node": "Respond with Result",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Postgres Screen Log",
            "type": "main",
            "index": 0
          },
          {
            "node": "Respond with Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

EAR/Export Control angle for crypto platforms: OFAC SDN screening results contain sensitive U.S. government sanctions intelligence. If your RegTech SaaS routes OFAC screening results through a foreign-owned cloud service (including EU-based cloud providers), you may be inadvertently exporting controlled information under EAR Part 744. Self-hosted n8n keeps OFAC screening results within a U.S.-controlled perimeter.

Workflow 5: Weekly RegTech Compliance KPI Dashboard

{
  "name": "Weekly RegTech Compliance KPI Dashboard",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1"
            }
          ]
        }
      },
      "id": "n1",
      "name": "Monday 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        240,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as sar_pending, SUM(CASE WHEN urgency='OVERDUE' THEN 1 ELSE 0 END) as sar_overdue, SUM(CASE WHEN ofac_result='OFAC_SDN_HIT' AND disposition='BLOCK' THEN 1 ELSE 0 END) as ofac_blocks_7d, SUM(CASE WHEN alert_type='CTR_REQUIRED' AND created_at >= NOW()-INTERVAL '7 days' THEN 1 ELSE 0 END) as ctr_filings_7d FROM bsa_sar_log WHERE created_at >= NOW()-INTERVAL '7 days'"
      },
      "id": "n2",
      "name": "Query BSA Incidents",
      "type": "n8n-nodes-base.postgres",
      "position": [
        460,
        200
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as worm_alerts, SUM(CASE WHEN alert_type='WORM_INTEGRITY_FAILURE' THEN 1 ELSE 0 END) as worm_failures, SUM(CASE WHEN urgency IN ('OVERDUE','CRITICAL') THEN 1 ELSE 0 END) as critical_deadlines FROM compliance_deadlines WHERE checked_at >= NOW()-INTERVAL '7 days'"
      },
      "id": "n3",
      "name": "Query Compliance Deadlines",
      "type": "n8n-nodes-base.postgres",
      "position": [
        460,
        450
      ]
    },
    {
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByIndex"
      },
      "id": "n4",
      "name": "Merge Queries",
      "type": "n8n-nodes-base.merge",
      "position": [
        680,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const d = $json;\nconst sar_pending = parseInt(d.sar_pending) || 0;\nconst sar_overdue = parseInt(d.sar_overdue) || 0;\nconst ofac_blocks = parseInt(d.ofac_blocks_7d) || 0;\nconst ctr_filings = parseInt(d.ctr_filings_7d) || 0;\nconst worm_failures = parseInt(d.worm_failures) || 0;\nconst critical_deadlines = parseInt(d.critical_deadlines) || 0;\n\nlet ragStatus, ragColor, executiveSummary;\nif (worm_failures > 0 || sar_overdue > 0) {\n  ragStatus = 'RED';\n  ragColor = '#c0392b';\n  executiveSummary = `CRITICAL: ${worm_failures} WORM integrity failure(s), ${sar_overdue} overdue SAR filing(s). Immediate CCO and General Counsel escalation required.`;\n} else if (critical_deadlines > 0 || ofac_blocks > 0) {\n  ragStatus = 'AMBER';\n  ragColor = '#d35400';\n  executiveSummary = `WARNING: ${critical_deadlines} critical regulatory deadline(s), ${ofac_blocks} OFAC block(s) this week. Review required.`;\n} else {\n  ragStatus = 'GREEN';\n  ragColor = '#27ae60';\n  executiveSummary = 'All BSA/AML, OFAC, and WORM record systems within compliance thresholds.';\n}\n\nconst html = `<h2 style='color:${ragColor}'>RegTech Weekly Compliance KPI \u2014 ${ragStatus}</h2><p>${executiveSummary}</p><table border='1' cellpadding='6'><tr><th>Metric</th><th>Value</th><th>Threshold</th></tr><tr><td>SAR Filings This Week</td><td>${sar_pending}</td><td>File within 30/60 days (31 CFR \u00a71020.320)</td></tr><tr><td>Overdue SARs</td><td style='color:${sar_overdue>0?'#c0392b':'#27ae60'}'>${sar_overdue}</td><td>0</td></tr><tr><td>OFAC SDN Blocks (7d)</td><td>${ofac_blocks}</td><td>File blocking report within 10 biz days (31 CFR \u00a7501.604)</td></tr><tr><td>CTR Filings (7d)</td><td>${ctr_filings}</td><td>File within 15 days (31 CFR \u00a71010.310)</td></tr><tr><td>WORM Integrity Failures</td><td style='color:${worm_failures>0?'#c0392b':'#27ae60'}'>${worm_failures}</td><td>0 \u2014 per se SEC Rule 17a-4 violation</td></tr><tr><td>Critical Compliance Deadlines</td><td style='color:${critical_deadlines>0?'#d35400':'#27ae60'}'>${critical_deadlines}</td><td>0</td></tr></table><p style='font-size:11px;color:#666'>n8n self-hosted: SAR data, OFAC screening results, and WORM audit logs never transit third-party iPaaS infrastructure. 31 USC \u00a75318(g)(2) tipping-off prohibition maintained. SEC Rule 17a-4(f) WORM audit trail within controlled perimeter.</p>`;\n\nreturn [{json: {html, ragStatus, ragColor, executiveSummary, sar_pending, sar_overdue, ofac_blocks, ctr_filings, worm_failures, critical_deadlines}}];"
      },
      "id": "n5",
      "name": "Build RAG KPI Report",
      "type": "n8n-nodes-base.code",
      "position": [
        900,
        300
      ]
    },
    {
      "parameters": {
        "fromEmail": "compliance@yourcompany.com",
        "toEmail": "cro@yourcompany.com",
        "subject": "=[{{ $json.ragStatus }}] RegTech Weekly Compliance KPI \u2014 {{ $json.executiveSummary.substring(0,80) }}",
        "html": "={{ $json.html }}"
      },
      "id": "n6",
      "name": "Email CRO + BCC General Counsel",
      "type": "n8n-nodes-base.gmail",
      "position": [
        1120,
        300
      ]
    }
  ],
  "connections": {
    "Monday 7AM": {
      "main": [
        [
          {
            "node": "Query BSA Incidents",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query Compliance Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query BSA Incidents": {
      "main": [
        [
          {
            "node": "Merge Queries",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Compliance Deadlines": {
      "main": [
        [
          {
            "node": "Merge Queries",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge Queries": {
      "main": [
        [
          {
            "node": "Build RAG KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build RAG KPI Report": {
      "main": [
        [
          {
            "node": "Email CRO + BCC General Counsel",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

BCC structure note: The BCC to General Counsel on the KPI email is intentional. FinCEN's anti-tipping-off provision (31 USC §5318(g)(2)) means that SAR-related communications should maintain a separation between compliance reporting and legal privilege. BCC creates a parallel attorney-client communication channel for SAR-adjacent KPI data without the BSA Officer's email being in the To/CC thread that compliance teams forward internally.

The Self-Hosting Argument for RegTech SaaS Clients

When you're selling compliance software to banks, broker-dealers, crypto exchanges, or insurance companies, your platform's data handling is part of their regulatory compliance posture. Here's the specific argument for each regulator:

FinCEN (Bank Compliance, Crypto): BSA SAR data in a third-party iPaaS = potential anti-tipping-off exposure (31 USC §5318(g)(2)). FinCEN examination teams review automation vendor access logs as part of BSA program adequacy reviews.

SEC/FINRA (Broker-Dealer, IA): FINRA Rule 4370 (BCP) and SEC Rule 17a-4(f)(3)(i) require records available within 1 business day. If your broker-dealer's compliance alerts run through Zapier and Zapier goes down during an SEC examination, the broker-dealer has a records production failure. Self-hosted n8n is within the broker-dealer's own infrastructure perimeter.

CFTC (Swap Dealers): CFTC Part 45 swap data must flow to a registered SDR. If your RegTech platform uses iPaaS to route swap continuation data, the iPaaS is in the data transmission chain between swap dealer and SDR. CFTC Regulation 1.31 requires records available for examination — same infrastructure argument as FINRA 4370.

ESMA/NCA (EU Crypto, MiCA): MiCA Art.70 complaint handling and Art.77 record-keeping require records maintained in the CASP's own controlled infrastructure. ESMA Q&A (May 2024) specifically notes that CASPs cannot delegate record-keeping obligations to cloud vendors without maintaining control over data retrieval. Self-hosted automation = data remains in CASP's own systems.

OFAC (All Financial SaaS): SDN screening results contain U.S. government sanctions intelligence. Routing through foreign-owned cloud services raises EAR Part 744 technology export questions. OFAC Advisory (October 2021) on virtual currency sanctions specifically notes vendor due diligence obligations for any service processing OFAC-relevant data.

Get These Workflows

All 5 n8n workflow JSON files are available at stripeai.gumroad.com — import directly into your n8n instance.

FlowKit n8n Automation Templates — built for SaaS vendors who need compliance automation that keeps sensitive regulatory data within their own infrastructure.

Disclaimer: This is technical automation guidance, not legal advice. Consult qualified securities, banking, or compliance counsel for your specific regulatory obligations.

n8n for InsurTech/Insurance SaaS Vendors: 5 Automations for NAIC, GLBA, TCPA, and Solvency II Compliance (Free Workflow JSON)

Alex Kane — Thu, 28 May 2026 22:02:34 +0000

Every insurance SaaS vendor processes policyholder PII, claims data, and pricing logic that touches at least three independent regulatory frameworks simultaneously. Here are five production-ready n8n workflows that keep your platform compliant — full import-ready JSON included.

The compliance stack for InsurTech SaaS

Regulation	Effective	Key Clock
NAIC Model Data Security Law #668	Varies by state (adopted 22+ states)	3-day investigation + 10-day policyholder notification
GLBA Safeguards Rule 16 CFR Part 314	June 9, 2023 (amended)	Annual risk assessment + vendor oversight program
TCPA FCC 23-107 one-to-one consent	January 27, 2025	Per-lead consent required — no batch consent chains
HIPAA 45 CFR §164 (group health plans)	Ongoing	60-day individual + HHS notification on breach
NY DFS 23 NYCRR 500 (Nov 2023)	Nov 1, 2023	72-hour material cybersecurity event notification
EU Solvency II 2009/138/EC	Ongoing	Annual SFCR + quarterly QRT reporting
FCRA 15 USC §1681m adverse action	Ongoing	5-day adverse action notice to consumer
NY Ins Law §3420	Ongoing	15-day proof-of-loss acknowledgment

The GLBA Safeguards Rule (June 2023 amendments) explicitly requires a written service provider oversight program — your iPaaS vendor (Zapier, Make) is a covered service provider under §314.4(f). That means a contract, an annual review, and documented controls. Self-hosted n8n eliminates the vendor from scope entirely.

The TCPA FCC 23-107 one-to-one consent rule (effective January 27, 2025) ended the batch-consent model: each consumer must give consent to each seller individually before receiving automated calls or texts. Insurance SaaS platforms that batch SMS through shared cloud automation tools cannot demonstrate per-lead consent chain traceability to the FCC.

Workflow 1: Insurance SaaS New Customer Onboarding Drip

Seven customer tiers with per-tier compliance flags at Day 0, Day 3, and Day 8:

{
  "name": "Insurance SaaS New Customer Onboarding Drip",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "insurance-customer-onboarding",
        "responseMode": "responseNode",
        "options": {}
      },
      "id": "n1",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        100,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "\nconst customer = $json;\nconst tier = customer.tier || 'INSURTECH_STARTUP';\nconst flags = {\n  PROPERTY_CASUALTY_SAAS: ['NAIC_DATA_SECURITY_MODEL_LAW','GLBA_SAFEGUARDS_16_CFR_314','NY_DFS_500_NOV2023','TCPA_FCC_23107_ONE_TO_ONE','FCRA_ADVERSE_ACTION_15USC1681M','CCPA_CPRA'],\n  LIFE_HEALTH_SAAS: ['NAIC_DATA_SECURITY_MODEL_LAW','HIPAA_45CFR164','GLBA_SAFEGUARDS_16_CFR_314','FCRA_ADVERSE_ACTION_15USC1681M','NY_DFS_500_NOV2023','TCPA_FCC_23107_ONE_TO_ONE'],\n  COMMERCIAL_LINES_SAAS: ['NAIC_DATA_SECURITY_MODEL_LAW','GLBA_SAFEGUARDS_16_CFR_314','GDPR_ART9_INSURANCE_DATA','SOX_ICFR_IF_PUBLIC','TCPA_FCC_23107_ONE_TO_ONE'],\n  REINSURANCE_SAAS: ['EU_SOLVENCY_II_2009_138_EC','NAIC_DATA_SECURITY_MODEL_LAW','GDPR_ART9_INSURANCE_DATA','SOX_ICFR_IF_PUBLIC','GLBA_SAFEGUARDS_16_CFR_314'],\n  INSURTECH_MGA_SAAS: ['NAIC_DATA_SECURITY_MODEL_LAW','GLBA_SAFEGUARDS_16_CFR_314','TCPA_FCC_23107_ONE_TO_ONE','FCRA_ADVERSE_ACTION_15USC1681M','STATE_SURPLUS_LINES_LICENSE'],\n  CLAIMS_MANAGEMENT_SAAS: ['NAIC_DATA_SECURITY_MODEL_LAW','HIPAA_45CFR164','TCPA_FCC_23107_ONE_TO_ONE','FCRA_ADVERSE_ACTION_15USC1681M','NY_INS_LAW_3420_PROOF_OF_LOSS'],\n  INSURTECH_STARTUP: ['NAIC_DATA_SECURITY_MODEL_LAW','GLBA_SAFEGUARDS_16_CFR_314','TCPA_FCC_23107_ONE_TO_ONE']\n};\nconst tierFlags = flags[tier] || flags['INSURTECH_STARTUP'];\nconst naic = tierFlags.includes('NAIC_DATA_SECURITY_MODEL_LAW') ? 'NAIC Model Data Security Law #668 investigation coordination required.' : '';\nconst hipaa = tierFlags.includes('HIPAA_45CFR164') ? 'HIPAA 45 CFR \u00a7164: PHI processing in automation vendor = Business Associate Agreement required before go-live.' : '';\nconst solvency = tierFlags.includes('EU_SOLVENCY_II_2009_138_EC') ? 'EU Solvency II 2009/138/EC Pillar 3 SFCR: ORSA data through Zapier/Make = regulatory reporting data out of EU perimeter.' : '';\nconst glba = tierFlags.includes('GLBA_SAFEGUARDS_16_CFR_314') ? 'GLBA Safeguards Rule 16 CFR Part 314 (June 2023): service provider oversight program required; Zapier/Make = covered service provider.' : '';\nconst tcpa = tierFlags.includes('TCPA_FCC_23107_ONE_TO_ONE') ? 'TCPA FCC 23-107 (Jan 27 2025): one-to-one consent required per lead; batch SMS/email through shared iPaaS = consent chain traceability risk.' : '';\nconst ny3420 = tierFlags.includes('NY_INS_LAW_3420_PROOF_OF_LOSS') ? 'NY Ins Law \u00a73420: 30-day proof-of-loss clock + 15-day acknowledgment. Claims automation in third-party cloud creates audit gap.' : '';\nreturn [{\n  json: {\n    ...customer,\n    tier,\n    compliance_flags: tierFlags,\n    naic_note: naic,\n    hipaa_note: hipaa,\n    solvency_note: solvency,\n    glba_note: glba,\n    tcpa_note: tcpa,\n    ny3420_note: ny3420,\n    day0_subject: `Welcome to FlowKit, ${customer.company_name} \u2014 Your Insurance SaaS Automation Is Live`,\n    day0_body: `Hi ${customer.contact_name},\\n\\nYour n8n automation platform is live. As a ${tier.replace(/_/g,' ')} vendor, your key compliance obligations are:\\n${naic}\\n${hipaa || glba}\\n${tcpa}\\n\\nAll workflow data stays in your VPC \u2014 no policyholder PII leaves your perimeter.\\n\\nYour onboarding specialist: compliance@flowkit.io\\n\\nFlowKit`,\n    onboarded_at: new Date().toISOString()\n  }\n}];\n",
        "mode": "runOnceForAllItems"
      },
      "id": "n2",
      "name": "Tier & Compliance Classifier",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        320,
        300
      ]
    },
    {
      "parameters": {
        "fromEmail": "onboarding@flowkit.io",
        "toEmail": "={{ $json.contact_email }}",
        "subject": "={{ $json.day0_subject }}",
        "text": "={{ $json.day0_body }}",
        "options": {}
      },
      "id": "n3",
      "name": "Day 0 Welcome Email",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        540,
        300
      ]
    },
    {
      "parameters": {
        "operation": "append",
        "documentId": {
          "__rl": true,
          "mode": "id",
          "value": "YOUR_SHEETS_ID"
        },
        "sheetName": {
          "__rl": true,
          "mode": "name",
          "value": "Onboarding"
        },
        "columns": {
          "mappingMode": "autoMapInputData",
          "value": {},
          "matchingColumns": []
        },
        "options": {}
      },
      "id": "n4",
      "name": "Log to Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "typeVersion": 4.5,
      "position": [
        760,
        300
      ]
    },
    {
      "parameters": {
        "amount": 3,
        "unit": "days"
      },
      "id": "n5",
      "name": "Wait 3 Days",
      "type": "n8n-nodes-base.wait",
      "typeVersion": 1.1,
      "position": [
        540,
        460
      ]
    },
    {
      "parameters": {
        "fromEmail": "onboarding@flowkit.io",
        "toEmail": "={{ $json.contact_email }}",
        "subject": "Day 3: Connect Your First Insurance API to n8n",
        "text": "Hi {{ $json.contact_name }},\n\nDay 3 check-in: have you connected your rating API or policy admin system yet?\n\nFor PROPERTY_CASUALTY and LIFE_HEALTH tiers, HIPAA/GLBA requires all API credentials stored in n8n credential vault \u2014 not hard-coded.\n\nFlowKit",
        "options": {}
      },
      "id": "n6",
      "name": "Day 3 Email",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        760,
        460
      ]
    },
    {
      "parameters": {
        "amount": 4,
        "unit": "days"
      },
      "id": "n7",
      "name": "Wait 4 Days",
      "type": "n8n-nodes-base.wait",
      "typeVersion": 1.1,
      "position": [
        540,
        620
      ]
    },
    {
      "parameters": {
        "fromEmail": "onboarding@flowkit.io",
        "toEmail": "={{ $json.contact_email }}",
        "subject": "Day 8: Your NAIC Data Security Incident Response Workflow Is Ready",
        "text": "Hi {{ $json.contact_name }},\n\nWeek 1 complete. Your NAIC Model Data Security Law #668 incident notification pipeline is pre-configured \u2014 3-day investigation report and 10-day policyholder notification clocks start automatically on webhook trigger.\n\nSelf-hosted n8n = you control the audit trail your state DOI will request during examination.\n\nFlowKit",
        "options": {}
      },
      "id": "n8",
      "name": "Day 8 Email",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        760,
        620
      ]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "{\"status\": \"onboarding_started\"}",
        "options": {}
      },
      "id": "n9",
      "name": "Respond to Webhook",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1.1,
      "position": [
        320,
        460
      ]
    }
  ],
  "connections": {
    "Webhook": {
      "main": [
        [
          {
            "node": "Tier & Compliance Classifier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Tier & Compliance Classifier": {
      "main": [
        [
          {
            "node": "Day 0 Welcome Email",
            "type": "main",
            "index": 0
          },
          {
            "node": "Respond to Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Day 0 Welcome Email": {
      "main": [
        [
          {
            "node": "Log to Sheets",
            "type": "main",
            "index": 0
          },
          {
            "node": "Wait 3 Days",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 3 Days": {
      "main": [
        [
          {
            "node": "Day 3 Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Day 3 Email": {
      "main": [
        [
          {
            "node": "Wait 4 Days",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait 4 Days": {
      "main": [
        [
          {
            "node": "Day 8 Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Tier flags: PROPERTY_CASUALTY_SAAS gets NAIC + GLBA + NY DFS + TCPA + FCRA + CCPA. LIFE_HEALTH_SAAS adds HIPAA (group health plans are covered entities under 45 CFR §160.103). REINSURANCE_SAAS gets EU Solvency II instead of TCPA (reinsurers don't contact consumers directly). CLAIMS_MANAGEMENT_SAAS gets NY Ins Law §3420 proof-of-loss clock annotation.

Workflow 2: Insurance API & Pricing Engine Health Monitor

Five endpoint types, each annotated with the regulation that makes downtime legally material:

{
  "name": "Insurance SaaS API & Pricing Engine Health Monitor",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 5
            }
          ]
        }
      },
      "id": "h1",
      "name": "Every 5 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.3,
      "position": [
        100,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "\nreturn [\n  { json: { endpoint_name: 'Rating Engine API', url: 'https://rating-api.internal/health', regulation: 'GLBA 16 CFR \u00a7314.4(f) \u2014 vendor API failure = safeguards gap', tier: 'PROPERTY_CASUALTY_SAAS' } },\n  { json: { endpoint_name: 'Policy Admin System', url: 'https://pas.internal/api/health', regulation: 'NAIC Data Security Model Law #668 \u00a74(F) \u2014 PAS outage = policyholder data access failure', tier: 'LIFE_HEALTH_SAAS' } },\n  { json: { endpoint_name: 'Claims Processing API', url: 'https://claims-api.internal/health', regulation: 'NY Ins Law \u00a73420 \u2014 15-day acknowledgment clock cannot pause for API downtime', tier: 'CLAIMS_MANAGEMENT_SAAS' } },\n  { json: { endpoint_name: 'HIPAA Eligibility Verification API', url: 'https://eligibility-api.internal/health', regulation: 'HIPAA 45 CFR \u00a7164.312(a)(2)(ii) \u2014 emergency access procedure required on HIPAA API failure', tier: 'LIFE_HEALTH_SAAS' } },\n  { json: { endpoint_name: 'Solvency II ORSA Reporting API', url: 'https://orsa-api.internal/health', regulation: 'EU Solvency II Art.45 ORSA \u2014 regulatory reporting API failure = Pillar 2 ORSA submission risk', tier: 'REINSURANCE_SAAS' } }\n];\n",
        "mode": "runOnceForAllItems"
      },
      "id": "h2",
      "name": "Build Endpoint List",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        300,
        300
      ]
    },
    {
      "parameters": {
        "method": "GET",
        "url": "={{ $json.url }}",
        "options": {
          "timeout": 8000,
          "response": {
            "response": {
              "neverError": true
            }
          }
        }
      },
      "id": "h3",
      "name": "Ping Each Endpoint",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [
        500,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "\nconst result = $json;\nconst statusCode = result.statusCode || 0;\nconst endpoint = $('Build Endpoint List').item.json;\nlet status = 'UP';\nlet severity = 'OK';\nif (statusCode === 0 || statusCode >= 500) { status = 'DOWN'; severity = 'CRITICAL'; }\nelse if (statusCode >= 400) { status = 'DEGRADED'; severity = 'WARNING'; }\nelse if (result.responseTime > 5000) { status = 'SLOW'; severity = 'WARNING'; }\nreturn [{ json: { ...endpoint, status, severity, statusCode, checked_at: new Date().toISOString(), alert_required: severity !== 'OK' } }];\n",
        "mode": "runOnceForEachItem"
      },
      "id": "h4",
      "name": "Evaluate Status",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        700,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": "",
            "typeValidation": "strict"
          },
          "conditions": [
            {
              "leftValue": "={{ $json.alert_required }}",
              "rightValue": true,
              "operator": {
                "type": "boolean",
                "operation": "true"
              }
            }
          ],
          "combinator": "and"
        }
      },
      "id": "h5",
      "name": "Alert Required?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        900,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "predefinedCredentialType",
        "resource": "channel",
        "operation": "post",
        "channel": "#insurtech-ops-alerts",
        "text": "={{ $json.severity }}: {{ $json.endpoint_name }} is {{ $json.status }} (HTTP {{ $json.statusCode }}) \u2014 Regulatory risk: {{ $json.regulation }}",
        "otherOptions": {}
      },
      "id": "h6",
      "name": "Slack Alert",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.2,
      "position": [
        1100,
        200
      ]
    }
  ],
  "connections": {
    "Every 5 Minutes": {
      "main": [
        [
          {
            "node": "Build Endpoint List",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Endpoint List": {
      "main": [
        [
          {
            "node": "Ping Each Endpoint",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Ping Each Endpoint": {
      "main": [
        [
          {
            "node": "Evaluate Status",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Evaluate Status": {
      "main": [
        [
          {
            "node": "Alert Required?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert Required?": {
      "main": [
        [
          {
            "node": "Slack Alert",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}

The NAIC Model Data Security Law §4(F) requires covered entities to implement access controls and monitoring — 'the API went down' is not an acceptable response to an examiner asking why policyholder records were inaccessible. The NY Ins Law §3420 15-day acknowledgment clock does not pause for API downtime.

Workflow 3: NAIC/GLBA/TCPA/HIPAA Compliance Deadline Tracker

Fourteen deadline types covering the full InsurTech regulatory stack:

{
  "name": "NAIC/GLBA/TCPA/HIPAA Compliance Deadline Tracker",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      },
      "id": "d1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.3,
      "position": [
        100,
        300
      ]
    },
    {
      "parameters": {
        "operation": "read",
        "documentId": {
          "__rl": true,
          "mode": "id",
          "value": "YOUR_SHEETS_ID"
        },
        "sheetName": {
          "__rl": true,
          "mode": "name",
          "value": "InsuranceDeadlines"
        },
        "options": {}
      },
      "id": "d2",
      "name": "Read Deadlines Sheet",
      "type": "n8n-nodes-base.googleSheets",
      "typeVersion": 4.5,
      "position": [
        300,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "\nconst now = new Date();\nconst deadlines = $input.all().map(item => item.json);\nconst DEADLINE_TYPES = [\n  'NAIC_DATA_SECURITY_INVESTIGATION_3DAY',\n  'NAIC_POLICYHOLDER_NOTIFICATION_10DAY',\n  'GLBA_SAFEGUARDS_ANNUAL_RISK_ASSESSMENT',\n  'GLBA_SAFEGUARDS_VENDOR_OVERSIGHT_REVIEW',\n  'NY_DFS_500_ANNUAL_CERT_FEB15',\n  'NY_DFS_500_72H_INCIDENT_NOTIFICATION',\n  'TCPA_ONE_TO_ONE_CONSENT_AUDIT',\n  'HIPAA_BAA_ANNUAL_REVIEW',\n  'HIPAA_BREACH_60DAY_HHS_NOTIFICATION',\n  'FCRA_ADVERSE_ACTION_NOTICE_5DAY',\n  'EU_SOLVENCY_II_SFCR_ANNUAL',\n  'EU_SOLVENCY_II_QRT_QUARTERLY',\n  'NY_INS_LAW_3420_15DAY_ACK',\n  'STATE_LICENSE_RENEWAL',\n];\nconst alerts = [];\nfor (const dl of deadlines) {\n  const due = new Date(dl.due_date);\n  const daysLeft = Math.floor((due - now) / 86400000);\n  let urgency = null;\n  if (daysLeft < 0) urgency = 'OVERDUE';\n  else if (daysLeft <= 1) urgency = 'CRITICAL';\n  else if (daysLeft <= 7) urgency = 'URGENT';\n  else if (daysLeft <= 21) urgency = 'WARNING';\n  else if (daysLeft <= 30) urgency = 'NOTICE';\n  if (urgency) alerts.push({ ...dl, urgency, days_left: daysLeft });\n}\nif (alerts.length === 0) return [{ json: { no_alerts: true } }];\nreturn alerts.map(a => ({ json: a }));\n",
        "mode": "runOnceForAllItems"
      },
      "id": "d3",
      "name": "Calculate Urgency",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        500,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": "",
            "typeValidation": "strict"
          },
          "conditions": [
            {
              "leftValue": "={{ $json.no_alerts }}",
              "rightValue": true,
              "operator": {
                "type": "boolean",
                "operation": "true"
              }
            }
          ],
          "combinator": "and"
        }
      },
      "id": "d4",
      "name": "Any Alerts?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        700,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "predefinedCredentialType",
        "resource": "channel",
        "operation": "post",
        "channel": "#insurance-compliance",
        "text": "={{ $json.urgency }}: {{ $json.deadline_type }} \u2014 {{ $json.days_left }} days left. Owner: {{ $json.owner }}. Regulation: {{ $json.regulation_cite }}.",
        "otherOptions": {}
      },
      "id": "d5",
      "name": "Slack Compliance Alert",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.2,
      "position": [
        900,
        200
      ]
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          {
            "node": "Read Deadlines Sheet",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Read Deadlines Sheet": {
      "main": [
        [
          {
            "node": "Calculate Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Calculate Urgency": {
      "main": [
        [
          {
            "node": "Any Alerts?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Any Alerts?": {
      "main": [
        [
          {
            "node": "Slack Compliance Alert",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}

The NY DFS 500.17 February 15 annual certification is the most commonly missed: it covers the prior calendar year, it is a Superintendent of Financial Services submission, and it requires documented attestation from a senior officer. Late filing = examination finding. The TCPA one-to-one consent audit (quarterly) reflects the FCC's enforcement posture post-FCC 23-107: carriers are checking whether platforms can demonstrate per-lead consent logs, not just policy acknowledgments.

Workflow 4: Insurance Regulatory Incident & Breach Pipeline

Eight incident types, each mapped to the specific regulatory clock that starts on detection:

{
  "name": "Insurance Regulatory Incident & Breach Pipeline",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "insurance-incident",
        "responseMode": "responseNode",
        "options": {}
      },
      "id": "i1",
      "name": "Incident Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        100,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "\nconst incident = $json;\nconst INCIDENT_CLOCKS = {\n  NAIC_DATA_SECURITY_BREACH: { immediateSlack: true, investigationDays: 3, policyholderDays: 10, label: 'NAIC Model Law #668: 3-day investigation + 10-day policyholder notification' },\n  NY_DFS_500_MATERIAL_CYBERSECURITY_EVENT: { immediateSlack: true, notificationHours: 72, label: 'NY DFS 23 NYCRR 500.17: 72-hour notification to NYDFS Superintendent' },\n  HIPAA_PHI_BREACH: { immediateSlack: true, individualDays: 60, hhs_days: 60, label: 'HIPAA 45 CFR \u00a7164.408: 60-day individual + HHS notification' },\n  GLBA_SAFEGUARDS_BREACH: { immediateSlack: true, label: 'GLBA Safeguards 16 CFR \u00a7314.4(h): notification to affected customers ASAP' },\n  TCPA_CONSENT_VIOLATION: { immediateSlack: false, auditRequired: true, label: 'TCPA FCC 23-107: one-to-one consent violation \u2014 $500/call statutory damages' },\n  FCRA_ADVERSE_ACTION: { immediateSlack: false, noticeDays: 5, label: 'FCRA 15 USC \u00a71681m: 5-day adverse action notice to consumer' },\n  SOLVENCY_II_BREACH: { immediateSlack: true, label: 'EU Solvency II Art.136: immediately notify EIOPA supervisory authority' },\n  NY_INS_LAW_3420_CLAIM_DELAY: { immediateSlack: false, ackDays: 15, label: 'NY Ins Law \u00a73420: 15-day proof-of-loss acknowledgment clock' },\n};\nconst clock = INCIDENT_CLOCKS[incident.incident_type] || { label: 'Unknown incident type', immediateSlack: true };\nconst now = new Date();\nconst deadline = {};\nif (clock.investigationDays) deadline.investigation = new Date(now.getTime() + clock.investigationDays * 86400000).toISOString();\nif (clock.policyholderDays) deadline.policyholder_notification = new Date(now.getTime() + clock.policyholderDays * 86400000).toISOString();\nif (clock.notificationHours) deadline.regulator_notification = new Date(now.getTime() + clock.notificationHours * 3600000).toISOString();\nif (clock.hhs_days) deadline.hhs_notification = new Date(now.getTime() + clock.hhs_days * 86400000).toISOString();\nif (clock.ackDays) deadline.ack_deadline = new Date(now.getTime() + clock.ackDays * 86400000).toISOString();\nreturn [{ json: { ...incident, clock_label: clock.label, immediate_slack: clock.immediateSlack, deadlines: deadline, detected_at: now.toISOString() } }];\n",
        "mode": "runOnceForAllItems"
      },
      "id": "i2",
      "name": "Map Regulatory Clocks",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        300,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": "",
            "typeValidation": "strict"
          },
          "conditions": [
            {
              "leftValue": "={{ $json.immediate_slack }}",
              "rightValue": true,
              "operator": {
                "type": "boolean",
                "operation": "true"
              }
            }
          ],
          "combinator": "and"
        }
      },
      "id": "i3",
      "name": "Immediate Alert?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [
        500,
        300
      ]
    },
    {
      "parameters": {
        "authentication": "predefinedCredentialType",
        "resource": "channel",
        "operation": "post",
        "channel": "#insurance-incidents-critical",
        "text": "INSURANCE INCIDENT: {{ $json.incident_type }} \u2014 {{ $json.clock_label }}. Deadlines: {{ JSON.stringify($json.deadlines) }}",
        "otherOptions": {}
      },
      "id": "i4",
      "name": "Slack Critical",
      "type": "n8n-nodes-base.slack",
      "typeVersion": 2.2,
      "position": [
        700,
        200
      ]
    },
    {
      "parameters": {
        "operation": "insert",
        "table": "insurance_incidents",
        "columns": "incident_type,clock_label,deadlines,detected_at,company_name",
        "options": {}
      },
      "id": "i5",
      "name": "Postgres Audit Log",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        700,
        460
      ]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "{\"status\": \"incident_logged\", \"deadlines\": \"{{ JSON.stringify($json.deadlines) }}\"}",
        "options": {}
      },
      "id": "i6",
      "name": "Respond 200",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1.1,
      "position": [
        900,
        300
      ]
    }
  ],
  "connections": {
    "Incident Webhook": {
      "main": [
        [
          {
            "node": "Map Regulatory Clocks",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Map Regulatory Clocks": {
      "main": [
        [
          {
            "node": "Immediate Alert?",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres Audit Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Immediate Alert?": {
      "main": [
        [
          {
            "node": "Slack Critical",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack Critical": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

The HIPAA 60-day breach notification clock (45 CFR §164.408) runs from the date the covered entity discovers the breach, not from the date it determines the breach was reportable. Group health plans often misread this as 60 days from determination — OCR enforcement actions have consistently held that discovery starts the clock. For NAIC states: the 3-day investigation report goes to the DOI Commissioner, and the 10-day policyholder notification is a separate obligation — missing either is an independent violation.

Workflow 5: Weekly Insurance SaaS Compliance KPI Dashboard

RAG-rated weekly report to CCO, BCC'd to CISO:

{
  "name": "Weekly Insurance SaaS Compliance KPI Dashboard",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      },
      "id": "k1",
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.3,
      "position": [
        100,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT incident_type, COUNT(*) as count, MAX(detected_at) as latest FROM insurance_incidents WHERE detected_at > NOW() - INTERVAL '7 days' GROUP BY incident_type ORDER BY count DESC;",
        "options": {}
      },
      "id": "k2",
      "name": "Query Incidents",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        300,
        200
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT deadline_type, COUNT(*) as overdue_count FROM insurance_deadlines WHERE due_date < NOW() AND resolved = false GROUP BY deadline_type;",
        "options": {}
      },
      "id": "k3",
      "name": "Query Overdue",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2.5,
      "position": [
        300,
        400
      ]
    },
    {
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByPosition",
        "options": {}
      },
      "id": "k4",
      "name": "Merge",
      "type": "n8n-nodes-base.merge",
      "typeVersion": 3,
      "position": [
        500,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "\nconst incidents = $('Query Incidents').all().map(i => i.json);\nconst overdue = $('Query Overdue').all().map(o => o.json);\nconst overdueCount = overdue.reduce((s, o) => s + parseInt(o.overdue_count || 0), 0);\nconst naic_breach = incidents.filter(i => i.incident_type === 'NAIC_DATA_SECURITY_BREACH');\nconst hipaa_breach = incidents.filter(i => i.incident_type === 'HIPAA_PHI_BREACH');\nconst nydfs_event = incidents.filter(i => i.incident_type === 'NY_DFS_500_MATERIAL_CYBERSECURITY_EVENT');\nconst rag = (overdueCount > 3 || naic_breach.length > 0 || hipaa_breach.length > 0) ? 'RED' : (overdueCount > 0 || nydfs_event.length > 0) ? 'AMBER' : 'GREEN';\nconst html = `<html><body style=\"font-family:sans-serif;max-width:700px;\">\n<h2>Insurance SaaS Compliance KPI \u2014 Week of ${new Date().toISOString().split('T')[0]}</h2>\n<p><strong>Overall Status:</strong> <span style=\"color:${rag==='RED'?'red':rag==='AMBER'?'orange':'green'}\">${rag}</span></p>\n<h3>Incidents (Last 7 Days)</h3>\n<ul>\n${incidents.map(i => `<li>${i.incident_type}: ${i.count} (latest: ${i.latest})</li>`).join('')}\n${incidents.length === 0 ? '<li>No incidents \u2014 all clear</li>' : ''}\n</ul>\n<h3>Overdue Compliance Items (${overdueCount})</h3>\n<ul>\n${overdue.map(o => `<li>${o.deadline_type}: ${o.overdue_count} overdue</li>`).join('')}\n${overdue.length === 0 ? '<li>No overdue items</li>' : ''}\n</ul>\n<p style=\"font-size:12px;color:#666;\">Self-hosted n8n \u2014 policyholder PII never leaves your VPC. NAIC DOI examinations can request audit trail directly from your instance.</p>\n</body></html>`;\nreturn [{ json: { html, rag, incident_count: incidents.length, overdue_count: overdueCount } }];\n",
        "mode": "runOnceForAllItems"
      },
      "id": "k5",
      "name": "Build KPI Report",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        700,
        300
      ]
    },
    {
      "parameters": {
        "fromEmail": "reports@flowkit.io",
        "toEmail": "cco@yourcompany.com",
        "subject": "Weekly Insurance SaaS Compliance KPI",
        "emailType": "html",
        "html": "={{ $json.html }}",
        "options": {
          "bcc": "ciso@yourcompany.com"
        }
      },
      "id": "k6",
      "name": "Email KPI to CCO",
      "type": "n8n-nodes-base.emailSend",
      "typeVersion": 2.1,
      "position": [
        900,
        300
      ]
    }
  ],
  "connections": {
    "Monday 8AM": {
      "main": [
        [
          {
            "node": "Query Incidents",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query Overdue",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Incidents": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Overdue": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Report": {
      "main": [
        [
          {
            "node": "Email KPI to CCO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Why BCC the CISO? The GLBA Safeguards Rule §314.4(h) requires the Board (or senior officer equivalent) to receive a written report on the information security program at least annually. Weekly KPIs create the audit trail that satisfies both the GLBA report requirement and the NY DFS 500.4(b) annual report to board obligation.

Self-hosting: why InsurTech SaaS vendors choose on-premise n8n

Scenario	Zapier/Make (cloud)	Self-hosted n8n
GLBA service provider oversight	Zapier/Make = covered service provider requiring §314.4(f) oversight	n8n on your VPC = no third-party in scope
NAIC DOI examination	Examiner requests workflow execution logs	Logs in your Postgres — produced directly
TCPA consent chain	Batch automation breaks per-lead traceability	Per-lead webhook, per-lead log in your DB
HIPAA BAA	BAA with Zapier/Make; data transits their servers	No BAA needed; PHI never leaves your cluster
Solvency II ORSA data	ORSA inputs transit third-party cloud	ORSA data stays in EU VPC
SOX ICFR (if public)	Automation vendor = IT general control scope	Self-hosted = git-versioned workflow = audit trail

Get the full 15-template FlowKit bundle

These five workflows are part of the FlowKit n8n Automation Bundle — 15 production-ready templates at stripeai.gumroad.com.

Individual templates: $12–$29. Full bundle: $97.